A critical vulnerability in Audiobookshelf allows unauthenticated attackers to steal OIDC tokens and perform full account takeover, including the creation of persistent administrative accounts.

The application fails to restrict OIDC redirect callback URLs, allowing an unauthenticated attacker to manipulate login links to redirect victims to attacker-controlled sites, thereby leaking sensitive authentication tokens.

The impact of this vulnerability is severe, as it enables complete account takeover of any user, including administrators. This leads to unauthorized access to all data managed by the server and potential persistence within the environment, warranting its high CVSS score of 8.8.

Immediate Action: Update Audiobookshelf to version 2.28.0 or later immediately to resolve the OIDC redirect validation flaw.

Proactive Monitoring: Review authentication logs and server access logs for anomalous redirect patterns or attempts to use unrecognized callback URLs.

Compensating Controls: Since no workarounds exist, ensure that OIDC providers are restricted to known, trusted domains, although a full software update remains the only definitive fix for this vulnerability.

Public Exploit Available: No (exploit_available: unknown).

Given the severity of the risk, specifically the potential for full administrative account takeover, organizations should prioritize patching their Audiobookshelf deployments. Ensure that all systems are upgraded to version 2.28.0 as soon as possible to mitigate the risk of token theft and unauthorized access.