AniWorld Downloader CVE-2026-108580

Exploitation requires the AniWorld Downloader WebUI to be network-reachable by the attacker (the /login POST handler) on a version before 5.3.0, where no login throttling or account lockout exists. Two concrete conditions enable the full attack: (1) the timing side-channel in verify_user, which hashed only when a user record existed, allowing username enumeration; (2) the absence of any per-IP or per-user failure cap, allowing unlimited password guesses. LIMITING FACTORS: the WebUI must actually be exposed to the attacker (a local-only or firewalled instance is not reachable), and successful takeover still depends on a guessable/weak password - strong unique credentials blunt the brute-force. The post-fix mitigation also notes that without a configured ANIWORLD_WEB_TRUSTED_PROXY, IP-based counting degrades behind a reverse proxy, but that concerns the fix, not the prerequisite to exploit the unpatched version.

This is a genuine but moderate-severity weakness, not a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) scores 6.9 (Medium) and is internally consistent with the description: a network-reachable, unauthenticated, low-complexity flaw with low confidentiality and low integrity impact and no availability impact. The CWE-307 (improper restriction of authentication attempts) classification matches the root cause - the pre-fix /login handler performed no rate limiting, and verify_user hashed only for existing users, leaking username validity through response timing. No EPSS score, CISA KEV listing, or confirmed public exploit code is present in the input, so there is no signal of active or widespread exploitation; a third-party write-up (hackmd.io) and a VulnCheck advisory document the technique but do not themselves constitute a weaponized exploit. The real-world risk is sharply gated by exposure and password strength: impact only materializes on WebUI instances that are reachable by the attacker AND protected by guessable credentials. The signals are not conflicting, but note the vendor scored impact as Low/Low rather than High despite the outcome being account takeover - appropriate here because success still depends on the victim's password quality, not on the flaw alone.

An attacker who can reach an exposed AniWorld Downloader WebUI sends repeated POST requests to /login, using the timing difference in verify_user responses to confirm valid usernames, then brute-forces passwords without any throttling or lockout. Because there is no rate limit in versions before 5.3.0, a weak or default admin password can be guessed and the account taken over. No public exploit is identified in the input, though a technical write-up describing the method exists.