CVE-2026-108580
AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login
phoenixthrush AniWorld Downloader
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 5.3.0AniWorld DownloaderCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.
Text from CVE List
Affected versions 1
- AniWorld Downloaderaffected: all versions before 5.3.0CVE List
References 6
- github.com/phoenixthrush/AniWorld-Downloader/commit/3c070bd10665377308a3092e11933681c18a5fd1Fixvia CVE List
- github.com/phoenixthrush/AniWorld-Downloader/releases/tag/v.5.3.0Fixvia CVE List
- hackmd.io/@haind/aniworld-login-brute-forceAdvisoryvia CVE List
- vulncheck.com/advisories/aniworld-downloader-before-5.3.0-webui-login-brute-force-via-loginAdvisoryvia CVE List
- github.com/phoenixthrush/AniWorld-Downloader/issues/334Referencevia CVE List
- github.com/phoenixthrush/AniWorld-Downloader/blob/bb13599d17937fdb4df2df699024bc233f0656f2/src/aniworld/web/auth.py#L239-L256Referencevia CVE List