Security Advisory

CVE-2026-73085

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-11 16:40:22

Last updated 2026-08-11 18:39:19

Assigner GitHub_M

CVSS score not scored

State PUBLISHED

Description

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.

← Browse all CVEs View on cve.org ↗