Cyber Resilience

CVE-2025-60538

Auth Bypass in Go-Shiori Shiori ≤ 1.7.4

Published
09 January 2026
Modified
22 January 2026
Patch / advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
EPSS Score 0.0037 29th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2025-60538 is a medium-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Go-Shiori Shiori. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-7 (Unsuccessful Logon Attempts) and AU-2 (Event Logging) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1110 Brute Force Credential Access
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
Why these techniques?

Lack of rate limiting on login page directly enables brute force credential attacks (T1110) to bypass authentication.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-58488Shared CWE-290
CVE-2025-56608Shared CWE-290
CVE-2026-24000Shared CWE-290
CVE-2026-46356Shared CWE-290
CVE-2023-43304Shared CWE-290
CVE-2025-54305Shared CWE-290
CVE-2025-32788Shared CWE-290
CVE-2026-35656Shared CWE-290
CVE-2024-36466Shared CWE-290
CVE-2025-59699Shared CWE-290

Affected Assets

go-shiori
shiori
≤ 1.7.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-7 Unsuccessful Logon Attempts
Detect
Catch it (NIST detect / respond)
  • SI-4 System Monitoring
  • AU-2 Event Logging
Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V10.4.16
  • V10.5.1
  • V11.4.3

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces limits on consecutive unsuccessful login attempts, blocking brute-force authentication bypass on the login page.

detect

Enables monitoring of authentication events to identify repeated failed login attempts indicative of brute force.

AU-2 Event Logging partial match
detect

Requires logging of logon events so that brute-force attempts against the login page can be recorded and reviewed.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 full match
prevents

Protecting, conveying, and verifying identity assertions specifically prevents the spoofing that enables authentication bypass.

PR.AA-03 mostly match
prevents

Requiring authentication of users/services/hardware directly counters spoofing-based bypass when strong methods are used.

PR.AA-02 partial match
prevents

Proofing and binding identities reduces spoofing opportunities during enrollment but does not address runtime authentication implementation flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

degrades

Secure authentication control directly mitigates authentication bypass by spoofing.

degrades

Authentication information management directly addresses credential handling that prevents spoofing.

detects

Security testing can detect spoofing vulnerabilities but does not prevent them by itself.

prevents

Access control policy reduces spoofing opportunities but does not prescribe authentication mechanisms.

prevents

Identity management supports unique identities but does not guarantee resistance to spoofing.

prevents

Access rights assignment limits exposure but does not enforce authentication strength.

References