Audiobookshelf versions prior to 2.33.0 contain a stored cross‑site scripting (XSS) flaw in the login page. The flaw arises from improper sanitization of the authLoginCustomMessage value sent to the /api/auth-settings endpoint, allowing an attacker who already holds administrative privileges to inject arbitrary HTML or JavaScript. When exploited, the malicious payload is rendered on the login page for all users, potentially enabling theft of session cookies, defacement of the site, or execution of arbitrary client‑side code. This weakness corresponds to CWE‑79.

The affected product is the advplyr Audiobookshelf self‑hosted audiobook and podcast server. All installations running a version earlier than 2.33.0 are vulnerable; the issue was rectified in 2.33.0.

The vulnerability is scored as CVSS 4.5, indicating low to moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker already possess administrative credentials, so the risk to an outsider is limited. Nonetheless, the presence of a stored XSS that affects every user’s experience makes it important to remediate promptly.