CVE-2023-51665 Audiobookshelf vulnerable to Blind SSRF in `Auth.js`

What is CVE-2023-51665?

CVE-2023-51665 is a medium-severity server-side request forgery vulnerability in advplyr audiobookshelf, published on 27 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.

Weakness: CWE-918

Which versions are affected by CVE-2023-51665?

It affects 1 product.

Products include Audiobookshelf Audiobookshelf.

How do I fix CVE-2023-51665?

No fix has been published for CVE-2023-51665 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-51665 being exploited?

There is no known exploitation of CVE-2023-51665 in the wild and no public exploit code.

Other vulnerabilities in advplyr audiobookshelf

• CVE-2025-57800 Audiobookshelf vulnerable to OIDC token exfiltration and account takeover High 8.8
• CVE-2025-25205 Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching High 8.2
• CVE-2023-47619 Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability High 8.1
• CVE-2023-47624 Audiobookshelf Arbitrary File Read Vulnerability High 7.5
• CVE-2025-46338 Audiobookshelf Vulnerable to Cross-Site-Scripting Reflected via POST Request in /api/upload Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gjgj-98v3-47pg.