Shiori is vulnerable to authentication bypass via a brute force attack

MEDIUM 6.5CVE-2025-60538 · GHSA-mw8h-g64c-rxv4 · GO-2026-4308 · Published 09/01/2026 · updated 17/06/2026

In short

CVE-2025-60538 is a MEDIUM (CVSS 6.5) vulnerability affecting github.com/go-shiori/shiori, shiori (go-shiori).
Chance of exploitation in the next 30 days (EPSS): 0.41%, higher than 35.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/go-shiori/shiori Go	`≤ 1.7.4all versions`	No fix yet
shiori go-shiori	`≤ 1.7.4`	No fix yet

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

NVD description

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.