CVE-2026-73085 advplyr CVE debrief

Who should care

Defenders responsible for Audiobookshelf deployments should assess exposure and apply the fix. This includes verifying authentication and authorization configurations to prevent unauthorized access and reviewing compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should review and update authentication and authorization configurations to prevent potential authentication bypass.

Why it matters

CVE-2026-73085 allows refresh tokens to authenticate as associated users, potentially leading to authentication bypass. Defenders should verify exposure and apply the fix in version 2.36.0.

• Verify authentication and authorization configurations to prevent unauthorized access
• Assess exposure and apply the fix to prevent potential authentication bypass

Technical summary

The jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0. Defenders should assess exposure and apply the fix to prevent potential authentication bypass and unauthorized access to API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh. The fix involves updating the jwtAuthCheck function to properly handle JWTs with the refresh token type.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix in version 2.36.0.

Recommended defensive actions

• Verify exposure by checking current Audiobookshelf version
• Apply the fix in version 2.36.0
• Review and update authentication and authorization configurations
• Verify authentication and authorization configurations to prevent unauthorized access
• Assess exposure and apply the fix to prevent potential authentication bypass
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references provide details on the vulnerability and fix. The jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.