CVE-2026-73085

Executive Summary

CVE-2026-73085 is a token-type confusion vulnerability in Audiobookshelf, a self-hosted audiobook and podcast server. Prior to version 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs carrying the refresh token type as valid bearer access tokens on API and WebSocket resource endpoints such as /api/me, instead of restricting them to /auth/refresh — allowing any holder of a refresh token to authenticate as the associated user. The issue is fixed in version 2.36.0; no public exploit, CVSS score, or evidence of in-the-wild exploitation is currently documented.

Technical Analysis

Audiobookshelf operates as a self-hosted server, meaning the authentication boundary is exposed directly to whichever networks can reach the instance — frequently the public internet when operators expose the web UI for remote listening. The application uses a JWT-based authentication model in which the server issues two distinct credential types: short-lived access tokens intended to authorize requests to protected API and WebSocket resource endpoints, and refresh tokens intended only for token renewal at the /auth/refresh endpoint.

The vulnerability resides in the jwtAuthCheck function in server/auth/TokenManager.js. This function is the centralized authorization gatekeeper for API and WebSocket resource endpoints. Prior to 2.36.0, it performs generic JWT validation (signature, expiry, structural integrity) but fails to enforce the token type as part of the authentication decision. As a result, a JWT whose type claim marks it as a refresh token is accepted as a bearer access token on resource endpoints. The intended scope boundary — refresh tokens may only be presented at /auth/refresh — is therefore never enforced by the server-side authorization layer.

This is a server-side validation logic flaw, not a cryptographic weakness. The JWT is validly signed and unexpired; the bug is that the verifier applies the wrong trust policy to it. The flaw is classified as CWE-287 (Improper Authentication) because the authentication check accepts a credential type it should reject, weakening the distinction between short-lived access tokens and long-lived refresh tokens. The NVD description specifically cites /api/me as an affected resource and notes that WebSocket endpoints are equally affected, meaning real-time features such as playback synchronization are also within the attack surface.

It is important to note what is not specified in the available data: the exact JWT claim name used to denote the refresh token type, the token lifetime configuration, and the mechanism by which an attacker would obtain a refresh token are not described. The practical prerequisite for exploitation is possession of a valid refresh token for a target account. No CVSS vector has been assigned (N/A), and the EPSS score of 0.00267 (19.0% percentile) indicates low current likelihood of exploitation. The CISA KEV catalog does not list this CVE.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper authentication / JWT type confusion) and the NVD description.

1. Reconnaissance / target identification. An attacker identifies an internet-facing Audiobookshelf instance, for example via Shodan queries such as title:"Audiobookshelf", or by enumerating self-hosted media servers on common ports. Version fingerprinting (login page, asset paths, API responses) determines whether the instance is running a build prior to 2.36.0 and therefore vulnerable.

2. Acquisition of a refresh token (precondition). The flaw is not directly triggerable without a valid refresh token for the target account. The NVD description does not specify token acquisition vectors; candidate channels for a real-world attacker include client-side compromise of a logged-in user's session storage, interception of poorly protected traffic, leakage via logs or backups, or a legitimate low-privileged user escalating their own token capabilities. Token theft vectors are not confirmed in the available data.

3. Triggering the flaw. The attacker presents the captured refresh JWT in the Authorization header of an HTTP request to an API resource endpoint such as /api/me, or during a WebSocket handshake targeting a protected resource. Because jwtAuthCheck fails to reject the refresh token type, the server performs the authentication decision as though a valid access token were presented, bypassing the intended restriction that refresh tokens are only valid at /auth/refresh. No token exchange or re-issuance step is required by the attacker.

4. Post-exploitation impact. Once authenticated, the attacker operates with the full API session context of the associated user account. If the account has administrative privileges, the attacker gains control over server configuration, user management, and library administration. Even for standard user accounts, the attacker can access profile data, personal library metadata, and any resources gated behind authenticated API/WebSocket endpoints. Because refresh tokens are designed to be long-lived, the unauthorized access window may persist well beyond the lifetime of a normal access token.

Impact Assessment

The business impact of CVE-2026-73085 is driven by Audiobookshelf's role as a self-hosted, often internet-exposed service that brokers access to personal media libraries and user accounts. The vulnerability effectively collapses the security boundary between two credential types: a refresh token — a credential that should only be usable for session renewal — becomes a universal session token for all API and WebSocket resources. This violates the principle of least privilege and enables:

• Confidentiality impact: unauthorized reading of user profiles, account metadata, library contents, and potentially media metadata for any account whose refresh token is obtainable.
• Integrity impact: a compromised account with write or administrative privileges can modify library metadata, user settings, user accounts, and server configuration.
• Availability impact: WebSocket endpoints are explicitly in scope; administrative compromise of a self-hosted instance can result in service disruption or data destruction.

CVSS: No score or vector has been published (N/A), so risk scoring must be qualitative. EPSS: 0.00267 (19.0% percentile) — no active exploitation is currently reflected in threat telemetry. CISA KEV: not listed. Public PoC: none known.

Blast radius: all Audiobookshelf deployments running versions prior to 2.36.0. Within a given deployment, every user account is at risk if its refresh token is exposed; the worst-case scenario is compromise of an administrative account, yielding full platform takeover. Organizations are advised to treat affected, internet-exposed instances as high-risk even in the absence of an observed exploit.

Detection Guidance

The detection rules below assume that HTTP server logs capture the full Authorization header (including the Bearer token). They further assume the JWT payload encodes the refresh type using a typ claim, producing the base64url payload prefix eyJ0eXAiOiJyZWZyZXNo (decoding to {"typ":"refresh...). Adjust the token marker if the implementation uses a different claim name.

Sigma Rule

title: Audiobookshelf Refresh Token Reuse on API Endpoints (CVE-2026-73085)
id: 7f9c2a1e-8b3d-4c6a-9f2e-1d4b8a0c6e2f
status: experimental
description: >
  Detects a JWT Bearer token previously presented to /auth/refresh being reused
  on /api/* resource endpoints within a short timeframe. This pattern matches the
  token-type confusion in CVE-2026-73085, where jwtAuthCheck in
  server/auth/TokenManager.js accepts refresh tokens as access tokens.
logsource:
  category: webserver
  product: audiobookshelf
detection:
  selection_auth_refresh:
    cs.uri.path: '/auth/refresh'
    cs.auth_header|startswith: 'Bearer '
  selection_resource:
    cs.uri.path|startswith: '/api/'
    cs.auth_header|startswith: 'Bearer '
  timeframe: 15m
  condition: selection_auth_refresh followed by selection_resource
fields:
  - src_ip
  - cs.auth_header
  - cs.uri.path
falsepositives:
  - Legitimate token renewal flows where the same client session logs both endpoints (investigate for token replay).
level: high

YARA Rule

rule CVE_2026_73085_Audiobookshelf_RefreshToken_Abuse
{
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2026-01-01"
        description = "Matches web/application log lines or captured HTTP exchanges showing a JWT with a refresh-type payload claim used as a Bearer token on Audiobookshelf API or WebSocket resource endpoints (CVE-2026-73085)."
        cve = "CVE-2026-73085"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73085"
    strings:
        $auth_header = "Authorization: Bearer " ascii nocase
        $jwt_refresh_payload = "eyJ0eXAiOiJyZWZyZXNo" ascii nocase  // base64url of {"typ":"refresh...
        $api_path = "/api/" ascii
        $api_me = "/api/me" ascii
        $ws_upgrade = "Upgrade: websocket" ascii nocase
    condition:
        $auth_header and $jwt_refresh_payload and ($api_path or $ws_upgrade)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Audiobookshelf refresh JWT presented on API resource endpoint (CVE-2026-73085)"; flow:established,to_server; http.uri; content:"/api/"; http.header; content:"Authorization"; content:"Bearer "; content:"eyJ0eXAiOiJyZWZyZXNo"; distance:0; reference:cve,2026-73085; classtype:attempted-admin; sid:202673085; rev:1;)

Elastic Detection

// Detect a JWT Bearer token first observed at /auth/refresh
// being reused on Audiobookshelf API/WebSocket resource endpoints.
sequence by http.request.headers.authorization
  [ any where url.path == "/auth/refresh"
      and startsWith(http.request.headers.authorization, "Bearer ") ]
  [ any where (url.path like "/api/*" or url.path == "/api/me")
      and startsWith(http.request.headers.authorization, "Bearer ") ]

Splunk SPL Query

index=web sourcetype=access_combined
| rex field=_raw "Authorization: Bearer (?<jwt>[^\"\s]+)"
| eval is_refresh_payload=if(match(jwt, "^eyJ0eXAiOiJyZWZyZXNo"), "true", "false")
| where is_refresh_payload="true" AND match(uri, "^/api/")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri jwt
| where count >= 1
| table _time first_seen last_seen src_ip uri jwt count
| sort - last_seen

Wazuh OSSEC Rule

<group name="audiobookshelf,">
  <rule id="100730" level="12">
    <decoded_as>web-access</decoded_as>
    <match>Authorization: Bearer eyJ0eXAiOiJyZWZyZXNo</match>
    <regex>GET /api/|POST /api/|/api/me</regex>
    <description>Audiobookshelf (CVE-2026-73085): refresh token used as bearer access token on API resource endpoint.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_failure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence rating: 2/4 (CLAIMED). The fix is claimed by a single source (OSV advisory) and has not been independently confirmed. Validate the update in a test environment before production rollout.

1. Immediate mitigations. No vendor-documented workaround exists for this issue (N/A). Until the patch can be applied, restrict network exposure of Audiobookshelf — place it behind a reverse proxy with an allowlist or VPN, and avoid direct internet exposure of the web UI, API, and WebSocket ports. Force all users to re-authenticate (invalidate existing sessions and stored tokens) to reduce the window for refresh-token abuse. Monitor access logs for the correlation pattern described in the Detection Guidance section (same Bearer token observed on /auth/refresh and then on /api/*).

2. Patch / upgrade steps. Upgrade Audiobookshelf to version 2.36.0 or later. After upgrading, confirm in a staging environment that jwtAuthCheck now rejects refresh-type JWTs on resource endpoints such as /api/me and WebSocket handshakes, and that refresh tokens are again confined to /auth/refresh. Because the patch claim originates from a single source, verify behavioral change with a manual test (present a refresh token to /api/me and confirm a 401 response).

3. Long-term hardening. Maintain a patching cadence for self-hosted services and subscribe to Audiobookshelf release notes. Enforce TLS in transit so tokens are not exposed to network observers. Audit user roles and reduce the number of accounts with administrative privileges. Add automated JWT fuzzing for token-type validation to the application test suite so regressions of this class are caught before release. Continue to monitor CISA KEV and public exploit databases for updates to the exploitation status of CVE-2026-73085.

References

1. NVD entry for CVE-2026-73085: https://nvd.nist.gov/vuln/detail/CVE-2026-73085
2. OSV vulnerability entry (patch source): https://osv.dev/vulnerability/CVE-2026-73085
3. CWE-287 Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
4. Audiobookshelf project repository: https://github.com/advplyr/audiobookshelf
5. CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-73085 is not listed)

Threat intelligence note. As of this writing, there are no known threat-actor campaigns, no public exploit code, no Nuclei template, and no CISA KEV listing associated with CVE-2026-73085. The EPSS score of 0.00267 (19.0% percentile) corroborates the absence of observed in-the-wild exploitation. Organizations running affected versions should still prioritize patching because self-hosted Audiobookshelf instances are routinely exposed to the internet and the technical precondition (refresh token possession) is achievable via multiple unpatched-adjacent channels such as client-side compromise.