Shiori is vulnerable to authentication bypass via a brute force attack

MEDIO 6.5CVE-2025-60538 · GHSA-mw8h-g64c-rxv4 · GO-2026-4308 · Published 09/01/2026 · updated 17/06/2026

En resumen

CVE-2025-60538 es una vulnerabilidad MEDIO (CVSS 6.5) que afecta a github.com/go-shiori/shiori, shiori (go-shiori).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.41%, mayor que el 35.2% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
github.com/go-shiori/shiori Go	`≤ 1.7.4all versions`	No fix yet
shiori go-shiori	`≤ 1.7.4`	No fix yet

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

NVD description

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.