What is the CVSS score of EUVD-2026-29210?

EUVD-2026-29210 has a CVSS 3.1 base score of 4.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-29210?

Yes, a patch is available for EUVD-2026-29210. Update the affected software to the latest version immediately.

Audiobookshelf EUVD-2026-29210

| CVE-2026-42887 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 GitHub_M

XSS Audiobookshelf

4.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.5 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 11, 2026 - 21:03 EUVD

Analysis Generated

May 11, 2026 - 20:31 vuln.today

CVE Published

May 11, 2026 - 19:55 nvd

MEDIUM 4.5

DescriptionGitHub Advisory

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site scripting (XSS) vulnerability exists in the Login Page due to improper sanitization of the authLoginCustomMessage field of the /api/auth-settings endpoint. An attacker with administrative privileges can inject arbitrary HTML/JavaScript that will be rendered on the login page for all users. This vulnerability is fixed in 2.33.0.

AnalysisAI

Stored cross-site scripting (XSS) in Audiobookshelf prior to 2.33.0 allows authenticated administrators to inject malicious HTML and JavaScript into the authLoginCustomMessage field via the /api/auth-settings endpoint, which is then rendered on the login page for all users without sanitization. This enables attackers with admin credentials to capture user credentials, perform account takeover, or redirect users to phishing sites. No public exploit code identified at time of analysis.

Technical ContextAI

Audiobookshelf is a self-hosted audiobook and podcast server application. The vulnerability exists in the authentication settings API endpoint (/api/auth-settings) which accepts user-controlled input for the authLoginCustomMessage field-a field intended to display custom text on the login page. The application fails to implement proper input sanitization or output encoding before rendering this message in the HTML context, allowing the CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability class. The stored nature of this XSS means the malicious payload persists in the application state and executes every time any user navigates to or loads the login page.

RemediationAI

Upgrade Audiobookshelf to version 2.33.0 or later, which includes fixes for the authLoginCustomMessage sanitization. For organizations unable to immediately patch, implement network-level access controls restricting access to the /api/auth-settings endpoint to trusted administrative networks only, and disable the custom login message feature if the application supports such configuration. Additionally, review audit logs for suspicious modifications to authentication settings and monitor for unusual login page behavior or user reports of unexpected content on the login screen. These compensating controls reduce exposure but do not eliminate the risk if an admin account is compromised.