CVE-2025-60538
Medium · 6.5Shiori is vulnerable to authentication bypass via a brute force attack
CVSS
6.5
EPSS
0.4%
Published
Jan 9, 2026
CISA due date
—
The record
A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/go-shiori/shiori | 0 | No fix |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260114T191543-150000.1.137.1 |
Related vulnerabilities
- GO-2026-4308 Shiori is vulnerable to authentication bypass via a brute force attack in… Same vulnerability
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb
- CVE-2026-33997 Moby is an open source container framework. Also affects govulncheck-vulndb
- CVE-2026-27018 Gotenberg is an API for converting document formats. Also affects govulncheck-vulndb