CVE-2026-73085: Audiobookshelf: Refresh Token Accepted on Resource Endpoints
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Audiobookshelfto a version that resolves this vulnerability.Fixed in 2.36.0
Event History
Frequently Asked Questions
What is CVE-2026-73085?
CVE-2026-73085 represents a vulnerability in Audiobookshelf where refresh tokens are incorrectly accepted on resource endpoints instead of being restricted to refresh operations.
What is the severity of CVE-2026-73085?
CVE-2026-73085 has a risk score of 62, indicating it poses a moderate security threat to users.
How do I fix CVE-2026-73085?
To fix CVE-2026-73085, you should upgrade Audiobookshelf to version 2.36.0 or later where this issue has been resolved.
Who is affected by CVE-2026-73085?
CVE-2026-73085 affects users of Audiobookshelf prior to version 2.36.0 who rely on JWT authentication for access control.
What are the potential impacts of CVE-2026-73085?
The potential impacts of CVE-2026-73085 include unauthorized access to protected resources due to improper validation of refresh tokens.