6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-60538

CVE-2025-60538: Shiori is vulnerable to authentication bypass via a brute force attack

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-60538

CVE-2025-60538:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/go-shiori/shiori	go	<= 1.7.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a lack of rate limiting on the login page, which allows for brute-force attacks. The analysis focused on identifying the code responsible for handling login requests. The advisory mentions that versions up to 1.7.4 are vulnerable and that no patch is available. By comparing the git tags for v1.7.4 and the next release candidate, I found a major refactoring of the HTTP server code. This refactoring replaced the gin framework with the standard library's http package.

I identified two vulnerable functions:

AuthAPIRoutes.loginHandler in internal/http/routes/api/v1/auth.go: This was the login handler in the vulnerable versions using the gin framework. It was removed during the refactoring.
api_v1.HandleLogin in internal/http/handlers/api/v1/auth.go: This is the new login handler introduced after the refactoring. It also lacks rate limiting.

Since the vulnerability is still unpatched, both the old and the new login handlers are considered vulnerable. An attacker could exploit this by repeatedly sending login requests to the /api/v1/auth/login endpoint with different passwords until the correct one is found.

Vulnerable functions

api_v1.HandleLogin

internal/http/handlers/api/v1/auth.go

This function, introduced in a refactoring, handles user login. It lacks any rate-limiting mechanism, making it susceptible to brute-force attacks where an attacker can make an unlimited number of password attempts.

AuthAPIRoutes.loginHandler

internal/http/routes/api/v1/auth.go

This function was the login handler in older versions of Shiori. It does not implement any rate-limiting, which allows an attacker to perform brute-force attacks by sending a large number of login requests with different passwords.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.