{"id":"CVE-2025-25205","aliases":["EUVD-2025-4091","GHSA-pg8v-5jcv-wrvw"],"status":"published","title":"Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching","description":"Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like \"/api/items/1/cover\" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.04753,"percentile":0.91956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-202","CWE-22","CWE-287","CWE-400"],"published":"2025-02-12T18:16:01Z","modified":"2026-10-28T02:31:08Z","exploits":[{"source":"metasploit","id":"auxiliary/scanner/http/audiobookshelf_auth_bypass","title":"Audiobookshelf Unauthenticated API Authentication Bypass Scanner","type":"auxiliary","date":"2025-02-12","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/audiobookshelf_auth_bypass"}],"products":[{"vendor":"advplyr","product":"audiobookshelf"},{"vendor":"audiobookshelf","product":"audiobookshelf"}],"references":[{"url":"https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/advplyr/audiobookshelf/pull/3584","tags":["x_refsource_MISC","Issue Tracking","Patch","fix"]},{"url":"https://github.com/advplyr/audiobookshelf/commit/bf8407274e3ee300af1927ee660d078a7a801e1c","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/advplyr/audiobookshelf/commit/ec6537656925a43871b07cfee12c9f383844d224","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/advplyr/audiobookshelf/blob/1a3d70d04100924d41391acb55bd8ddca486a4fa/server/Auth.js#L17-L41","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25205.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25205","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71209.json","tags":["advisory"]},{"url":"https://github.com/advplyr/audiobookshelf","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71209","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-25205","title":"Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching","description":"Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like \"/api/items/1/cover\" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.","status":"published","published":"2025-02-12T18:16:01.326Z","modified":"2025-02-13T14:14:25.849Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-202","CWE-287","CWE-400"],"updated_at":"2026-11-02T14:32:31.971896Z"}],"euvd":[{"id":"EUVD-2025-4091","description":"Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like \"/api/items/1/cover\" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.","status":"published","published":"2025-02-12T18:16:01Z","modified":"2025-02-13T14:14:25Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:55.950052Z"}],"nvd":[{"id":"CVE-2025-25205","description":"Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like \"/api/items/1/cover\" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.","status":"published","published":"2025-02-12T19:15:21.717Z","modified":"2026-06-17T09:00:28.913Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-202","CWE-287","CWE-400"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"CVE-2025-25205","title":"Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching","description":"Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like \"/api/items/1/cover\" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.","status":"published","published":"2025-02-12T18:16:01.326Z","modified":"2026-10-28T02:31:08.83200853Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-202","CWE-287","CWE-400"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"CVE-2026-71209","title":"audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal","description":"audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.","status":"published","published":"2026-08-05T06:59:16.579Z","modified":"2026-10-28T02:30:42.102453343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:15.164658Z"}]}}