Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2025-57800 is a high-severity Unprotected Transport of Credentials (CWE-523) vulnerability in Audiobookshelf Audiobookshelf. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28630
Vulnerability Data
Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary callback in…
more
a cookie, which is later used to redirect the user after authentication. The server then issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows an attacker to obtain the victim's tokens and perform full account takeover, including creating persistent admin users if the victim is an administrator. Tokens are further leaked via browser history, Referer headers, and server logs. This vulnerability impacts all Audiobookshelf deployments using OIDC; no IdP misconfiguration is required. The issue is fixed in version 2.28.0. No known workarounds exist.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
V3.4.5V14.2.1V3.7.2
Mitigating Controls (NIST 800-53 r5) AI
SC-8 requires confidentiality protection for transmitted data, directly stopping credentials from traveling in plaintext.
Input validation directly checks and rejects untrusted redirect targets before they are used in a response.
Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption of data-in-transit directly prevents exposure of credentials during login.
Protecting identity assertions in transit covers credential transport but is narrower than the full control scope.
Secure SDLC practices directly prevent embedding sensitive data in query strings as part of input-handling and data-flow design.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires use of cryptography, directly enabling encryption of credentials in transit.
Security testing can detect sensitive data leakage via query strings.
Requires secure information transfer, which can include protecting credentials in transit.
Addresses management of authentication information, indirectly supporting protection during transmission.
DLP solutions can detect and block sensitive data in URLs.
Requires network security controls that can protect credential transmission.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
RHEL 8 (2 rules)
- V-230487 RHEL 8 must not have the telnet-server package installed. prevents CWE-523
- V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-523