CVE-2026-42887 is a stored XSS vulnerability in advplyr's Audiobookshelf product affecting versions before 2.33.0. The vulnerability arises from improper neutralization of input in the authLoginCustomMessage field of the /api/auth-settings endpoint, allowing an attacker with admin privileges to inject malicious HTML/JavaScript. This code is then rendered on the login page for all users, potentially leading to client-side script execution. The CVSS 3.1 base score is 4.5, reflecting network attack vector, low attack complexity, high privileges required, and user interaction needed, with high confidentiality impact but no integrity or availability impact. The vulnerability is resolved in version 2.33.0.

An attacker with administrative privileges can inject malicious scripts into the login page, which will be executed in the context of users visiting that page. This can lead to disclosure of sensitive information accessible to the browser (confidentiality impact). There is no direct impact on integrity or availability. The vulnerability requires high privileges and user interaction, limiting the ease of exploitation.

Upgrade Audiobookshelf to version 2.33.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 2.33.0, applying this official update fully mitigates the issue. No additional mitigations are specified or required.