Audiobookshelf Unauthenticated API Authentication Bypass Scanner

This module detects Audiobookshelf servers affected by CVE-2025-25205, an
unauthenticated authentication bypass. Affected versions (2.17.0 through
2.19.0) decide whether a GET request may skip authentication by testing an
unanchored regular expression against the request's full original URL,
including the query string, rather than the normalized path. By appending a
query parameter whose value contains a whitelisted substring such as
/api/items/1/cover, an unauthenticated client reaches protected API
endpoints.

The module fingerprints the server and version through the unauthenticated
/status endpoint, then sends two requests to the protected /api/libraries
endpoint: a baseline request that must be rejected with HTTP 401, and a
bypass request carrying the whitelisted substring in its query string. On a
vulnerable server the bypass request is processed instead of rejected, which
this module treats as confirmation. It deliberately avoids endpoints such as
/api/users that crash the server process (the denial-of-service half of this
CVE).

swiftbird07
Kenneth LaCroix