PT-2026-1823 · Shiori · Shiori

CVE-2025-60538 · Published 2026-01-09 · Updated 2026-01-17

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions shiori versions 1.7.4 and below

Description A missing rate limit on the login page allows attackers to bypass authentication through brute-force attempts. The affected component is the login functionality, specifically the authentication process. The API endpoint involved is the login page. The vulnerability allows attackers to attempt multiple login requests without restriction, potentially guessing valid credentials.

Recommendations Apply rate limiting to the login page to restrict the number of login attempts within a specific timeframe.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-60538

GHSA-MW8H-G64C-RXV4

GO-2026-4308

SUSE-SU-2026:0142-1

Affected Products

Shiori

References · 43

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60538.json · Exploit
• https://osv.dev/vulnerability/GO-2026-4308 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mw8h-g64c-rxv4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60538 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0142-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60538 · Vendor Advisory
• https://github.com/go-shiori/shiori · Note
• https://github.com/go-shiori/shiori/issues/1138 · Note
• https://suse.com/security/cve/CVE-2017-18901 · Note
• https://suse.com/security/cve/CVE-2017-18905 · Note
• https://suse.com/security/cve/CVE-2017-18894 · Note
• https://suse.com/security/cve/CVE-2025-68954 · Note
• https://suse.com/security/cve/CVE-2026-22253 · Note
• https://suse.com/security/cve/CVE-2017-18893 · Note
• https://github.com/advisories/GHSA-mw8h-g64c-rxv4 · Note