CVE-2026-42887

4.5 Moyenne

Publiée le 11/05/2026 à 22:25 · Modifiée le 17/06/2026 à 12:48 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting (XSS) vulnerability exists in the Login Page due to improper sanitization of the authLoginCustomMessage field of the /api/auth-settings endpoint. An attacker with administrative privileges can inject arbitrary HTML/JavaScript that will be rendered on the login page for all users. This vulnerability is fixed in 2.33.0.

Traduire en français

Produits concernés

advplyr audiobookshelf

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-cx29-ghq2-9cm4
https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-cx29-ghq2-9cm4

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories