CVE-2026-73085 - Audiobookshelf: Refresh Token Accepted on Resource Endpoints
Brief
CVE ID : CVE-2026-73085
Published : Aug. 11, 2026, 4:40 p. m.
- 23 minutes ago
Description : Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.
- 0, the jwtAuthCheck function in server/auth/TokenManager. js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.
- 0.
Severity: 0.0
- NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...