CVE-2026-42887: Audiobookshelf Stored XSS Vulnerability

CVE-2026-42887 Overview

CVE-2026-42887 is a stored cross-site scripting (XSS) vulnerability in Audiobookshelf, a self-hosted audiobook and podcast server. The flaw exists in versions prior to 2.33.0 and stems from improper sanitization of the authLoginCustomMessage field exposed by the /api/auth-settings endpoint. An attacker with administrative privileges can inject arbitrary HTML or JavaScript that renders on the login page for every user who visits it. The issue is tracked under [CWE-79] and fixed in version 2.33.0.

Critical Impact
Authenticated administrators can persist malicious scripts on the login page, executing in the browser context of any user attempting to authenticate.

Affected Products

Audiobookshelf versions prior to 2.33.0
Self-hosted Audiobookshelf instances exposing the /api/auth-settings endpoint
Deployments with multiple administrative users or shared admin credentials

Discovery Timeline

2026-05-11 - CVE-2026-42887 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42887

Vulnerability Analysis

The vulnerability resides in how Audiobookshelf processes the authLoginCustomMessage setting. Administrators can configure a custom message displayed on the login screen through the /api/auth-settings endpoint. The application stores this value without sanitizing HTML or JavaScript content and renders it directly into the login page DOM.

When any user navigates to the login page, the injected payload executes in their browser session. Because the login page is publicly accessible, the payload reaches both authenticated and unauthenticated visitors. The vulnerability is classified as Improper Neutralization of Input During Web Page Generation [CWE-79].

The attack requires high privileges, as only administrators can modify authLoginCustomMessage. However, in environments with multiple administrators, compromised admin credentials, or insider threats, the payload can harvest credentials submitted through the login form or pivot to session theft once users authenticate.

Root Cause

The root cause is missing output encoding on the authLoginCustomMessage field. The Audiobookshelf frontend renders the stored message as HTML rather than as text, allowing <script> tags and event-handler attributes to execute. No content-type restriction or HTML entity encoding is applied between storage and rendering.

Attack Vector

An attacker with administrative access sends a crafted payload to /api/auth-settings, setting authLoginCustomMessage to a string containing JavaScript such as inline script tags or event handlers on benign-looking elements. The server persists the value. On the next visit to the login page, the browser parses the payload as HTML and executes the embedded script. The script runs with access to the login form, enabling credential theft, redirection to phishing pages, or token exfiltration once a user logs in.

For technical details and the patched commit, refer to the GitHub Security Advisory GHSA-cx29-ghq2-9cm4.

Detection Methods for CVE-2026-42887

Indicators of Compromise

Unexpected HTML tags, <script> elements, or JavaScript event handlers in the authLoginCustomMessage configuration value
Outbound requests from user browsers to unfamiliar domains immediately after loading the login page
Modifications to /api/auth-settings from administrator accounts that do not normally manage authentication configuration

Detection Strategies

Inspect the current authLoginCustomMessage value via the admin UI or API and verify it contains only plain text
Review web server and application logs for PUT or POST requests to /api/auth-settings and correlate with the originating administrator account
Monitor login page responses for HTML content that deviates from the expected template baseline

Monitoring Recommendations

Alert on any change to authentication settings endpoints and require a documented change ticket
Implement Content Security Policy (CSP) headers and log CSP violation reports to surface unexpected inline script execution
Track administrator account activity, especially configuration changes occurring outside business hours

How to Mitigate CVE-2026-42887

Immediate Actions Required

Upgrade Audiobookshelf to version 2.33.0 or later, which sanitizes the authLoginCustomMessage field
Audit the current value of authLoginCustomMessage and reset it to plain text or an empty string if any HTML or JavaScript is present
Rotate credentials and session tokens for users who may have logged in while a malicious payload was active

Patch Information

The vulnerability is fixed in Audiobookshelf 2.33.0. The maintainers applied input sanitization to the authLoginCustomMessage field handling. Review the GitHub Security Advisory GHSA-cx29-ghq2-9cm4 for the official fix details and release notes.

Workarounds

Restrict administrative access to a minimal set of trusted accounts and enforce multi-factor authentication on those accounts
Place the Audiobookshelf instance behind a reverse proxy that enforces a strict Content Security Policy, blocking inline scripts on the login page
Limit network access to the /api/auth-settings endpoint to internal management networks where feasible

bash

# Example: enforce CSP via reverse proxy (nginx) to block inline scripts on the login page
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;