CVE-2026-108580
6.5 MEDIUMpublic exploit availablePublished 2026-10-10 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-307
Public exploit & PoC references
- https://github.com/phoenixthrush/AniWorld-Downloader/blob/bb13599d17937fdb4df2df699024bc233f0656f2/src/aniworld/web/auth.py#L239-L256
- https://github.com/phoenixthrush/AniWorld-Downloader/commit/3c070bd10665377308a3092e11933681c18a5fd1
- https://github.com/phoenixthrush/AniWorld-Downloader/issues/334
- https://github.com/phoenixthrush/AniWorld-Downloader/releases/tag/v.5.3.0
All references
- https://github.com/phoenixthrush/AniWorld-Downloader/blob/bb13599d17937fdb4df2df699024bc233f0656f2/src/aniworld/web/auth.py#L239-L256
- https://github.com/phoenixthrush/AniWorld-Downloader/commit/3c070bd10665377308a3092e11933681c18a5fd1
- https://github.com/phoenixthrush/AniWorld-Downloader/issues/334
- https://github.com/phoenixthrush/AniWorld-Downloader/releases/tag/v.5.3.0
- https://hackmd.io/@haind/aniworld-login-brute-force
- https://www.vulncheck.com/advisories/aniworld-downloader-before-5.3.0-webui-login-brute-force-via-login
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100501PoC
- MEDIUMCVE-2026-100678PoC
- HIGHCVE-2026-102334PoC
- LOWCVE-2026-102825PoC
- HIGHCVE-2026-103977PoC
- LOWCVE-2026-105237PoC
- CRITICALCVE-2026-105638PoC
- HIGHCVE-2026-105835PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.