Audiobookshelf, a self‑hosted audiobook and podcast server, treats JWTs marked as refresh tokens as bearer access tokens on protected API and WebSocket endpoints such as /api/me. As a result, any user possessing a valid refresh token can impersonate that user on any resource endpoint, bypassing the intended separation between access and refresh token usage. The vulnerability is an authentication flaw (CWE‑287) that allows an attacker who obtains a victim’s refresh token to gain unauthorized access to the victim’s account data and actions.

Audiobookshelf self‑hosted server from all releases before version 2.36.0. The issue is fixed starting with v2.36.0, so any deployment running a version earlier than 2.36.0 is vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is less than 1 %, showing a low probability of exploitation as of the current data set, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an attacker who already has a victim’s refresh token—obtained through phishing, credential stuffing, or other means—using it to authenticate API requests. Because the flaw only impacts authenticated users, a successful exploit requires possession of a token, but once in hand it provides full user privileges and therefore a high potential impact.