AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login

Advisories

AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login

severity: medium
date: 10/10/2026
Affecting: AniWorld Downloader >= 0, < 5.3.0
CVE: CVE-2026-108580
CWE: CWE-307 Improper Restriction of Excessive Authentication Attempts
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://github.com/phoenixthrush/AniWorld-Downloader/issues/334
https://github.com/phoenixthrush/AniWorld-Downloader/commit/3c070bd10665377308a3092e11933681c18a5fd1
AniWorld Downloader v.5.3.0 Release Notes
https://hackmd.io/@haind/aniworld-login-brute-force
https://github.com/phoenixthrush/AniWorld-Downloader/blob/bb13599d17937fdb4df2df699024bc233f0656f2/src/aniworld/web/auth.py#L239-L256
Credit: SiroxCW, HaiND from the Post and Telecommunication Institute of Technology
Description: AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo