CVE-2025-60538: 
NixOS vulnerability analysis and mitigation

CVE-2025-60538 is a missing rate-limiting vulnerability in Shiori, an open-source bookmark manager written in Go, that allows unauthenticated attackers to bypass authentication via brute force attacks against the login page. It affects Shiori v1.7.4 and all earlier versions. The vulnerability was reported on August 28, 2025, published to the NVD on January 9, 2026, and reviewed in the GitHub Advisory Database on January 13, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Red Hat CVE).

The root cause is the absence of any rate limiting or account lockout mechanism on Shiori's login endpoint, classified as CWE-290 (Authentication Bypass by Spoofing). Because the application imposes no restriction on the number of login attempts, an unauthenticated remote attacker can submit an unlimited number of credential guesses over the network with low complexity and no user interaction required. The vulnerability was originally reported via a GitHub issue where the reporter demonstrated exploitation using Burp Suite's Intruder tool to automate credential stuffing against the login POST request (Shiori Issue, Github Advisory).

Successful exploitation allows an attacker to gain unauthorized access to a victim's Shiori account, exposing all stored bookmarks and any associated metadata, which may include sensitive or private URLs. The CVSS assessment reflects low confidentiality impact (access to bookmark data) and low availability impact, with no integrity impact noted. Since Shiori supports multiple user accounts and administrative roles, compromise of an admin account could affect all users of a shared instance (Github Advisory, Red Hat CVE).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation at this time. The attack requires no authentication, no special privileges, and no user interaction, making it trivially executable by any network-accessible attacker. The EPSS score is approximately 0.06% (0.018% per GitHub Advisory), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Red Hat CVE).

1. Reconnaissance: Identify internet-facing or network-accessible Shiori instances running v1.7.4 or earlier using tools like Shodan, Censys, or by scanning for the default Shiori web interface port.
2. Capture login request: Navigate to the Shiori login page and capture the HTTP POST request (e.g., using Burp Suite or a browser proxy) to identify the credential submission endpoint and parameter names.
3. Prepare wordlist: Assemble a password wordlist (e.g., common passwords, leaked credential lists) targeting the known or guessed username (default admin account is often shiori).
4. Launch brute force: Use Burp Suite Intruder, Hydra, or a custom script to send repeated POST requests to the login endpoint with varying passwords, exploiting the absence of rate limiting or lockout.
5. Gain access: Upon a successful credential match (indicated by a different HTTP response code or redirect), authenticate to the Shiori instance and access all stored bookmarks and user data (Shiori Issue).

• Network: High volume of HTTP POST requests to the Shiori login endpoint (e.g., /api/v1/auth/login or equivalent) from a single IP or small range of IPs in a short time window; sequential or rapid-fire login attempts with varying password fields.
• Logs: Shiori application or web server access logs showing repeated failed authentication attempts (HTTP 401 or similar) from the same source IP, followed by a successful login (HTTP 200); unusual login times or geographic locations.
• Process/Session: Unexpected new sessions or authenticated activity immediately following a burst of failed login attempts; admin-level actions (e.g., bulk bookmark export or user management) performed shortly after suspicious login patterns.

The GitHub Advisory notes that no patched version has been formally designated as of the advisory's last update (January 13, 2026); however, Shiori v1.8.0 was released on September 26, 2025, and users should upgrade to the latest available release above v1.7.4 (Shiori Repo). As interim mitigations, administrators should deploy a reverse proxy or WAF (e.g., nginx, Cloudflare) in front of Shiori configured with rate limiting rules on the login endpoint, and consider restricting access to trusted IP ranges. Implementing account lockout or CAPTCHA at the network or application layer, and using strong, unique passwords for all accounts, will further reduce risk (Github Advisory, Red Hat CVE).

The vulnerability was reported by a community member (vityuasdop) via a GitHub issue on August 28, 2025, and labeled as a bug by the Shiori maintainers, though no public maintainer statement or patch announcement has been made specifically addressing this CVE. Red Hat has tracked the issue in their CVE database. Coverage has been limited to automated vulnerability aggregators and a brief write-up on infinitsec.net, with no significant broader media or researcher commentary observed (Shiori Issue, Red Hat CVE).