LOWVulnerability
CVE-2026-73085
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.
Properties
- epss_score
- 0.00267
- cve_id
- CVE-2026-73085
- published_at
- 2026-08-11T17:19:16.557
- last_modified
- 2026-09-09T20:46:02.457
- epss_percentile
- 0.1878
Related Entities (3)
ENRICHED_BY (1)
→[Source]FIRST EPSS
HAS_WEAKNESS (1)
→[Weakness]Improper Authentication
DESCRIBED_BY (1)
→[Source]NVD
Explore deeper with Ninja Signal's threat intelligence graph