What is the CVSS score of CVE-2025-60538?

CVE-2025-60538 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Shiori are affected by CVE-2025-60538?

Organizations using the login page of shiori should be aware of notable risk from CVE-2025-60538 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-60538?

Within 30 days: Identify affected systems running the login page of shiori and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Shiori CVE-2025-60538

MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-01-09 cve@mitre.org

GHSA-mw8h-g64c-rxv4

Authentication Bypass Shiori Suse Go Shiori

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 09, 2026 - 21:16 nvd

MEDIUM 6.5

DescriptionCVE.org

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

AnalysisAI

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack. [CVSS 6.5 MEDIUM]

Technical ContextAI

Classified as CWE-290 (Authentication Bypass by Spoofing). Affects Shiori. A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.