CVE-2026-42887 is a stored cross-site scripting vulnerability in the advplyr audiobookshelf product, affecting versions before 2.33.0. The vulnerability arises from improper neutralization of input in the authLoginCustomMessage field of the /api/auth-settings endpoint. An attacker with admin privileges can inject malicious HTML or JavaScript that is rendered on the login page, potentially impacting users who visit that page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 4.5, indicating medium severity. The flaw is resolved in audiobookshelf version 2.33.0.

The vulnerability allows an attacker with administrative privileges to inject arbitrary HTML or JavaScript into the login page, which will be executed in the browsers of users visiting that page. This can lead to the execution of malicious scripts in the context of the affected site, potentially compromising user interactions on the login page. There is no indication of known exploits in the wild. The impact is limited to confidentiality as per the CVSS vector (C:H/I:N/A:N).

Upgrade audiobookshelf to version 2.33.0 or later, where this vulnerability is fixed. Since the vulnerability requires administrative privileges to exploit, restricting admin access and reviewing custom login messages can reduce risk until the update is applied. Patch status is not explicitly stated in a vendor advisory, but the description confirms the fix is included in version 2.33.0.