Vulnerability · Published Oct 10, 2026 · Assigned by VulnCheck

CVE-2026-108580AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login

Medium 6.5

In plain English

A medium-severity security flaw in AniWorld Downloader from phoenixthrush. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.

Affected products (as reported)

Vendor	Product	Versions
phoenixthrush	AniWorld Downloader	0 – before 5.3.0

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/phoenixthrush/AniWorld-Downloader/issues/334 issue-tracking
https://github.com/phoenixthrush/AniWorld-Downloader/commit/3c070bd10665377308a3092e11933681c18a5fd1 patch
AniWorld Downloader v.5.3.0 Release Notes release-notes
https://hackmd.io/@haind/aniworld-login-brute-force third-party-advisory
https://github.com/phoenixthrush/AniWorld-Downloader/blob/bb13599d17937fdb4df2df699024bc233f0656f2/src/aniworld/web/auth.py#L239-L256 technical-description
VulnCheck Advisory: AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login third-party-advisory