← All advisories

Moderate severityOSV Advisory· Published Jan 9, 2026· Updated Jan 9, 2026

CVE-2025-60538

CVE-2025-60538

Description

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/go-shiori/shioriGo	<= 1.7.4	—

Affected products

3

Go Shiori/ShioriOSV
Range: v0.9, v1.0, v1.5.0, …
ghsa-coords2 versions
pkg:golang/github.com/go-shiori/shiori pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
<= 1.7.4+ 1 more
- (no CPE)range: <= 1.7.4
- (no CPE)range: < 0.0.20260114T191543-150000.1.137.1

Patches

Vulnerability mechanics

References

3

github.com/advisories/GHSA-mw8h-g64c-rxv4ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-60538ghsaADVISORY
github.com/go-shiori/shiori/issues/1138ghsaWEB

News mentions

0

No linked articles in our index yet.