The vulnerability exists in the generate_auth_token function within Calibre-Web's kobo_auth.py endpoint, where manipulating the user_id argument allows attackers to create a valid authentication token for any user. This flaw bypasses normal access controls and grants unauthorized access to the Calibre-Web service, potentially exposing all stored e‑books, metadata, and user data. The exploit is publicly available and can be triggered remotely by sending crafted requests to the vulnerable endpoint.

janeczku Calibre-Web versions up to 0.6.26 are affected. Any deployment running these releases without an update is at risk.

With a CVSS score of 5.3 the issue delivers moderate severity. No EPSS score is published, and the vulnerability is not listed in CISA KEV, but public exploits exist, indicating that attackers may already be leveraging it. The attack vector is remote via HTTP requests to the kobo_auth.py endpoint, and success requires no special privileges. Given the lack of an available patch from the vendor, the risk remains present until a fix is released or mitigations are applied.