CVE-2025-57800: 
NixOS vulnerability analysis and mitigation

Audiobookshelf, an open-source self-hosted audiobook server, contains a critical security vulnerability in versions 2.6.0 through 2.26.3. The vulnerability stems from improper restriction of redirect callback URLs during OIDC authentication, which was discovered and disclosed on August 22, 2025. The issue affects all Audiobookshelf deployments using OIDC authentication, with no IdP misconfiguration required (GitHub Advisory).

The vulnerability occurs when the application fails to properly validate callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary callback in a cookie, which is later used to redirect the user after authentication. The server then issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is tracked under CWE-523 (Unprotected Transport of Credentials), CWE-598 (Use of GET Request Method With Sensitive Query Strings), and CWE-601 (URL Redirection to Untrusted Site) (GitHub Advisory).

The vulnerability enables complete account takeover and, if the victim is an administrator, allows attackers to create persistent admin users. Tokens are exposed via multiple channels including attacker logs, browser history, reverse-proxy logs, and as Referer headers to same-origin endpoints. The impact affects any Audiobookshelf deployment using OIDC authentication, regardless of IdP configuration (GitHub Advisory).

The vulnerability has been fixed in version 2.28.0. The fix includes removing or strictly restricting callbacks in the web flow, allowing only same-origin relative paths or a tight HTTPS allow-list with exact matching. Additionally, tokens are no longer placed in URLs, and a Referrer-Policy header has been added as a defense-in-depth measure. For affected versions, no known workarounds exist (GitHub Advisory, GitHub Commit).