A flaw in the Kobo authentication token generator allows an attacker to create valid tokens without proper authorization, enabling unauthorized access to protected resources. The vulnerability is triggered through the generate_auth_token function in cps/kobo_auth.py and can be exploited remotely. The impact is the ability to impersonate a legitimate user or service. The weakness relates to improper privilege or authority checks.

Crocodilestick’s Calibre-Web-Automated application up to version 4.0.6 is vulnerable. The issue is confined to the Kobo auth-token Route component. An upgrade to version 4.0.7, identified by commit 9f50bb2c16160564c9f8777dc2ceed3eb95e4807, removes the flaw.

The vulnerability scores a CVSS vector of 5.3, indicating moderate severity, and no EPSS information is available. It is not listed in CISA’s KEV catalog. Because the exploit is publicly available and can be performed over the network, the risk of exploitation is non‑negligible for exposed installations. Proper authorization checks are unintentionally bypassed, making the weakness most relevant for attackers who can reach the target system. Monitoring for unauthorized token creation or attempts remains prudent until an administrative patch is applied.