CVE-2025-62614: BookLore Auth Bypass Vulnerability

CVE-2025-62614 Overview

CVE-2025-62614 is an authentication bypass vulnerability in BookLore, a self-hosted web application for organizing personal book collections. The flaw exists in the BookMediaController and affects versions 1.8.1 and prior. Multiple media endpoints lack proper access control annotations, and the CoverJwtFilter continues request processing even when no authentication token is supplied. Unauthenticated remote attackers can enumerate and download book covers, thumbnails, and complete PDF or CBX page content. The vulnerability fully bypasses the application's canDownload permission model. The issue is tracked under CWE-862: Missing Authorization and was patched in commit b226c43.

Critical Impact
Unauthenticated attackers can exfiltrate the entire BookLore content library by enumerating media endpoints, bypassing all download permission checks.

Affected Products

BookLore versions 1.8.1 and prior
BookLore BookMediaController media endpoints
BookLore CoverJwtFilter authentication filter

Discovery Timeline

2025-10-22 - CVE-2025-62614 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-62614

Vulnerability Analysis

The vulnerability stems from two flaws in BookLore's authentication architecture. First, the BookMediaController exposes endpoints that serve covers, thumbnails, and reader content for PDF and CBX files without requiring access control annotations. Second, the CoverJwtFilter only validated the token query parameter when one was present, falling through silently when the parameter was missing. An attacker who omits the token parameter entirely bypasses authentication and reaches downstream controller logic. The filter's permissive design defeats the intended canDownload enforcement applied to authenticated users.

Root Cause

The root cause is a missing authorization check classified under CWE-862. The filter logic wrapped token validation inside an if (token != null) block without an else branch that rejected anonymous requests. Combined with controller methods that lacked Spring Security annotations, every media route became reachable to unauthenticated clients.

Attack Vector

The attack is remote and requires no authentication, privileges, or user interaction. An attacker sends HTTP GET requests to BookLore media endpoints, iterating book identifiers and page numbers to enumerate and exfiltrate library content. Because the filter accepts requests with no token, the attacker never needs valid credentials or a stolen JWT.

java

// Patch in CoverJwtFilter.java - reject requests with no token
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
    String token = request.getParameter("token");
    if (token == null || token.isEmpty()) {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Missing authentication token");
        return;
    }
    try {
        if (jwtUtils.validateToken(token)) {
            authenticateLocalUser(token, request);
        } else if (appSettingService.getAppSettings().isOidcEnabled()) {
            authenticateOidcUser(token, request);
        } else {
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid token");
            return;
        }
    } catch (Exception ex) {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authentication failed: " + ex.getMessage());
    }
}
// Source: https://github.com/booklore-app/booklore/commit/b226c43343cd0cef4c1cd54bc3dcdef90b147133

Detection Methods for CVE-2025-62614

Indicators of Compromise

HTTP GET requests to BookLore /media/* endpoints that lack a token query parameter and return HTTP 200 responses
Sequential or enumerated requests for book identifiers, cover images, thumbnails, or PDF/CBX page resources from a single source IP
Unusual outbound bandwidth spikes from BookLore hosts correlating with bulk media downloads
Access log entries showing media downloads with no preceding authentication event

Detection Strategies

Inspect BookLore application and reverse proxy access logs for requests to media endpoints lacking the token parameter prior to the patch in commit b226c43
Correlate request volume against authenticated session counts to identify anonymous bulk retrieval
Deploy web application firewall rules that flag unauthenticated access to /media paths

Monitoring Recommendations

Enable verbose request logging on the BookLore reverse proxy with client IP, URI, and response size fields
Forward logs to a centralized analytics platform such as the Singularity Data Lake for retention and query against enumeration patterns
Alert on more than a threshold of /media requests per minute from a single IP without a corresponding login event

How to Mitigate CVE-2025-62614

Immediate Actions Required

Upgrade BookLore beyond version 1.8.1 to a release containing commit b226c43
Restrict BookLore network exposure to trusted networks or VPN clients until patched
Review historical access logs for unauthenticated media requests and assess data exposure
Rotate any credentials or API tokens stored alongside the affected instance as a precaution

Patch Information

The issue is fixed in commit b226c43 of the BookLore repository. The patch requires a valid token parameter on the CoverJwtFilter path and removes unauthenticated entry points from BookMediaController. See the GitHub Security Advisory GHSA-363g-fhcq-hvqp and the upstream commit for technical details.

Workarounds

Place BookLore behind an authenticating reverse proxy that requires credentials before forwarding to /media endpoints
Apply IP allowlists at the network or proxy layer restricting access to known clients
Block external access to BookLore and require VPN connectivity for users until upgrade is possible

bash

# Example nginx snippet requiring basic auth on /media paths as a temporary mitigation
location /media/ {
    auth_basic "BookLore Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://booklore-backend;
}