Audiobookshelf Unauthenticated API Authentication Bypass Scanner

Description

This module detects Audiobookshelf servers affected by CVE-2025-25205, an unauthenticated authentication bypass. Affected versions (2.17.0 through 2.19.0) decide whether a GET request may skip authentication by testing an unanchored regular expression against the request's full original URL, including the query string, rather than the normalized path. By appending a query parameter whose value contains a whitelisted substring such as /api/items/1/cover, an unauthenticated client reaches protected API endpoints.

The module fingerprints the server and version through the unauthenticated /status endpoint, then sends two requests to the protected /api/libraries endpoint: a baseline request that must be rejected with HTTP 401, and a bypass request carrying the whitelisted substring in its query string. On a vulnerable server the bypass request is processed instead of rejected, which this module treats as confirmation. It deliberately avoids endpoints such as /api/users that crash the server process (the denial-of-service half of this CVE).