Back to Database
Status published
Medium
CVE-2023-51665
Audiobookshelf vulnerable to Blind SSRF in `Auth.js`
Vulnerability Description
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-51665
Credits & Attribution
No credits recorded in the NVD database.
References
More from advplyr
View All →CVE-2025-57800
Audiobookshelf vulnerable to OIDC token exfiltration and account takeover
High
8.8
CVE-2025-46338
Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload
Medium
6.9
CVE-2025-25205
Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching
High
8.2
CVE-2024-43797
Path Traversal in audiobookshelf
Medium
6.3
CVE-2024-35236
Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks
Medium
4.8
Affected Vendor
advplyr
View all reports →Affected Software
audiobookshelf
Vulnerable Versions:
< 2.7.0
Timeline
Official Publish:
December 27th, 2023
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N