CVE-2026-73085

Publié : 11 août 2026

Modifié : 11 août 2026

Description détaillée

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.

Références et Patchs

https://github.com/advplyr/audiobookshelf/commit/8ec547e30289ca61ebc52b13d150e3a2a6c6a752 https://github.com/advplyr/audiobookshelf/discussions/4460 https://github.com/advplyr/audiobookshelf/pull/5387 https://github.com/advplyr/audiobookshelf/releases/tag/v2.36.0 https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-798w-wv6c-2c3h https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-798w-wv6c-2c3h

Dernières Vulnérabilités

CVE-2026-73283

In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.

VOIR DÉTAILS

CVE-2026-73282

In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.

VOIR DÉTAILS

CVE-2026-73281

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.

VOIR DÉTAILS