starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[security concerns]: Chromecast, use of token in http #2751

New Issue
Closed
opened 2026-04-25 00:10:11 +02:00 by adam · 1 comment
adam commented 2026-04-25 00:10:11 +02:00
Owner
Copy Link
Copy Source

Originally created by @Torstein-Eide on GitHub (May 4, 2025).

What happened?

When a file is played on a Chromecast current we use a url like this:

https://$SERVER/audiobookshelf/api/items/$UUID/file/652771?token=$USER_TOKEN

Where the issue is the $USER_TOKEN

This can be read from any device that can talk to the chromecast:

Note

This output is from go-chromecast

DEBU[0009] (4)sender-0 <- e101d974-9787-4bec-b7da-07ec20d87ff3 [urn:x-cast:com.google.cast.media]: 
{
  "type": "MEDIA_STATUS",
  "status": [
    {
      "mediaSessionId": 1,
      "playbackRate": 1,
      "playerState": "PLAYING",
      "currentTime": 68622.981421,
      "supportedMediaCommands": 12303,
      "volume": {
        "level": 1,
        "muted": false
      },
      "activeTrackIds": [],
      "media": {
        "contentId": "https://$SERVER/audiobookshelf/api/items/$UUID/file/652771?token=$USER_TOKEN",
        "contentType": "audio/mp4",
        "duration": 185066.901,
        "itemId": 1,
        "metadata": {
          "bookTitle": "Executive Orders",
          "chapterNumber": 1,
          "chapterTitle": "Executive_Orders.m4a",
          "images": [
            {
              "url": "https://$SERVER/audiobookshelf/api/items/$UUID/cover?ts=1746125226501"
            }
          ],
          "metadataType": 5,
          "subtitle": "Executive Orders",
          "title": "Executive_Orders.m4a",
          "type": 5
        },
        "streamType": "BUFFERED",
        "mediaCategory": "AUDIO",
        "tracks": [],
        "breakClips": [],
        "breaks": []
      },
      "queueData": {
        "containerMetadata": {
          "authors": [
            "Tom Clancy"
          ],
          "containerType": 1,
          "narrators": [
            "Michael Prichard"
          ],
          "publisher": "Penguin",
          "title": "Executive Orders"
        },
        "description": "",
        "id": "$UUID",
        "name": "Executive Orders",
        "queueType": "AUDIOBOOK",
        "repeatMode": false,
        "shuffle": false,
        "startIndex": 0,
        "startTime": 50769
      },
      "currentItemId": 1,
      "items": [
        {
          "autoplay": true,
          "media": {
            "contentId": "https://$SERVER/audiobookshelf/api/items/$UUID/file/652771?token=$USER_TOKEN",
            "contentType": "audio/mp4",
            "duration": 185066.901,
            "itemId": 1,
            "metadata": {
              "bookTitle": "Executive Orders",
              "chapterNumber": 1,
              "chapterTitle": "Executive_Orders.m4a",
              "images": [
                {
                  "url": "https://$SERVER/audiobookshelf/api/items/$UUID/cover?ts=1746125226501"
                }
              ],
              "metadataType": 5,
              "subtitle": "Executive Orders",
              "title": "Executive_Orders.m4a",
              "type": 5
            },
            "streamType": "BUFFERED"
          },
          "preloadTime": 0,
          "startTime": 0,
          "itemId": 1,
          "orderId": 0
        }
      ],
      "repeatMode": "REPEAT_OFF"
    }
  ],
  "requestId": 4
}

With the $USER_TOKEN any device on the network is able to get access to the personal  token. and paste it in to browser you get full access to that users access, I.e. full admin acess for most servers.

What did you expect to happen?

I expect that there is created a ephemeral token per session, that limits the access to book/audio media that is send.

This will limit the consequences if nefarious users is on the network.

Steps to reproduce the issue

  1. log in to Audiobookshelf 
  2. Connect to a chromecast
  3. Cast any audiobook
  4. use a tool like go-chromecast to get current status from device.
  5. copy url in to a browser. 
    https://$SERVER/?token=$USER_TOKEN

Audiobookshelf version

v2.21.0

How are you running audiobookshelf?

Debian/PPA

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Originally created by @Torstein-Eide on GitHub (May 4, 2025). ### What happened? When a file is played on a Chromecast current we use a url like this: ```http https://$SERVER/audiobookshelf/api/items/$UUID/file/652771?token=$USER_TOKEN ``` Where the issue is the `$USER_TOKEN` This can be read from any device that can talk to the chromecast: > [!Note] > This output is from [go-chromecast](https://github.com/vishen/go-chromecast) ```json DEBU[0009] (4)sender-0 <- e101d974-9787-4bec-b7da-07ec20d87ff3 [urn:x-cast:com.google.cast.media]: { "type": "MEDIA_STATUS", "status": [ { "mediaSessionId": 1, "playbackRate": 1, "playerState": "PLAYING", "currentTime": 68622.981421, "supportedMediaCommands": 12303, "volume": { "level": 1, "muted": false }, "activeTrackIds": [], "media": { "contentId": "https://$SERVER/audiobookshelf/api/items/$UUID/file/652771?token=$USER_TOKEN", "contentType": "audio/mp4", "duration": 185066.901, "itemId": 1, "metadata": { "bookTitle": "Executive Orders", "chapterNumber": 1, "chapterTitle": "Executive_Orders.m4a", "images": [ { "url": "https://$SERVER/audiobookshelf/api/items/$UUID/cover?ts=1746125226501" } ], "metadataType": 5, "subtitle": "Executive Orders", "title": "Executive_Orders.m4a", "type": 5 }, "streamType": "BUFFERED", "mediaCategory": "AUDIO", "tracks": [], "breakClips": [], "breaks": [] }, "queueData": { "containerMetadata": { "authors": [ "Tom Clancy" ], "containerType": 1, "narrators": [ "Michael Prichard" ], "publisher": "Penguin", "title": "Executive Orders" }, "description": "", "id": "$UUID", "name": "Executive Orders", "queueType": "AUDIOBOOK", "repeatMode": false, "shuffle": false, "startIndex": 0, "startTime": 50769 }, "currentItemId": 1, "items": [ { "autoplay": true, "media": { "contentId": "https://$SERVER/audiobookshelf/api/items/$UUID/file/652771?token=$USER_TOKEN", "contentType": "audio/mp4", "duration": 185066.901, "itemId": 1, "metadata": { "bookTitle": "Executive Orders", "chapterNumber": 1, "chapterTitle": "Executive_Orders.m4a", "images": [ { "url": "https://$SERVER/audiobookshelf/api/items/$UUID/cover?ts=1746125226501" } ], "metadataType": 5, "subtitle": "Executive Orders", "title": "Executive_Orders.m4a", "type": 5 }, "streamType": "BUFFERED" }, "preloadTime": 0, "startTime": 0, "itemId": 1, "orderId": 0 } ], "repeatMode": "REPEAT_OFF" } ], "requestId": 4 } ``` With the `$USER_TOKEN` any device on the network is able to get access to the personal  token. and paste it in to browser you get full access to that users access, I.e. full admin acess for most servers. ### What did you expect to happen? I expect that there is created a ephemeral token per session, that limits the access to book/audio media that is send. This will limit the consequences if nefarious users is on the network. ### Steps to reproduce the issue 1. log in to Audiobookshelf  2. Connect to a chromecast 3. Cast any audiobook 4. use a tool like [go-chromecast](https://github.com/vishen/go-chromecast) to get current status from device. 5. copy url in to a browser. ```http https://$SERVER/?token=$USER_TOKEN ``` ### Audiobookshelf version v2.21.0 ### How are you running audiobookshelf? Debian/PPA ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None
adam added the bug label 2026-04-25 00:10:11 +02:00
adam closed this issue 2026-04-25 00:10:11 +02:00
adam commented 2026-04-25 00:10:12 +02:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (May 15, 2025):

Fixed in v2.22.0.

@github-actions[bot] commented on GitHub (May 15, 2025): Fixed in [v2.22.0](https://github.com/advplyr/audiobookshelf/releases/tag/v2.22.0).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2751
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?