Skip to content
OpenAdvisories
High · 8.2 Public exploit CVE-2025-25205 EUVD-2025-4091

Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

Published Feb 12, 2025 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: advplyr Product: audiobookshelf

Description

Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like "/api/items/1/cover" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.

Affected products

VendorProductAffectedFixed
advplyr audiobookshelf >= 2.17.0, < 2.19.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References