CVE-2026-71209 Details
Description
audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.
An authentication bypass vulnerability has been identified in Audiobookshelf versions 2.17.0 through 2.19.0. The issue arises in the authentication logic, where unauthenticated GET requests can match certain unanchored regex patterns in the URL. This allows attackers to bypass authentication checks and access protected resources. The vulnerability can be exploited by crafting URLs that include specific substrings, such as '/api/items/1/cover', in query parameters. This bypasses authentication and can lead to unauthorized access to information or, in some cases, cause a server crash by triggering endpoints that expect an authenticated user.
Users can update to Audiobookshelf version 2.19.1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/advplyr/audiobookshelf | TuranSec | Vendor |
| https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw | TuranSec | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| advplyr audiobookshelf | >= 2.17.0, <= 2.19.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |