CVE-2026-42887: Audiobookshelf: Stored Cross-Site Scripting in Login Page Custom Message
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting (XSS) vulnerability exists in the Login Page due to improper sanitization of the authLoginCustomMessage field of the /api/auth-settings endpoint. An attacker with administrative privileges can inject arbitrary HTML/JavaScript that will be rendered on the login page for all users. This vulnerability is fixed in 2.33.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42887?
The severity of CVE-2026-42887 is classified as high due to the potential for stored cross-site scripting vulnerabilities.
How do I fix CVE-2026-42887?
To fix CVE-2026-42887, upgrade Audiobookshelf to version 2.33.0 or later.
What is the impact of CVE-2026-42887?
The impact of CVE-2026-42887 allows authenticated attackers with administrative privileges to execute arbitrary scripts in the context of the affected web application.
Which versions of Audiobookshelf are affected by CVE-2026-42887?
Versions of Audiobookshelf prior to 2.33.0 are affected by CVE-2026-42887.
Is CVE-2026-42887 a public vulnerability?
Yes, CVE-2026-42887 is a public vulnerability that has been disclosed and documented for users and organizations to address.