CVE-2026-108580 in AniWorld Downloader
Summary
by MITRE • 10/10/2026
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in AniWorld Downloader versions prior to 5.3.0 represents a critical failure in access control mechanisms, specifically categorized under CWE-307 as Improper Restriction of Excessive Authentication Attempts. This flaw resides within the WebUI login POST handler and fundamentally undermines the security posture of any instance where this interface is exposed or accessible. The core technical deficiency lies in the absence of rate limiting or account lockout policies that are standard practice for securing authentication endpoints against automated attacks. By failing to implement throttling mechanisms, the application allows an unlimited number of credential verification requests from a single source within a short timeframe, effectively removing the primary defense against brute-force and password guessing campaigns.
From an operational perspective, this vulnerability enables unauthenticated attackers to perform systematic enumeration of valid usernames through timing analysis on the verify_user response. The application exhibits differential response times or behaviors that allow an attacker to distinguish between existing and non-existing user accounts with high accuracy. Once a valid username is identified, the lack of authentication attempt restrictions permits rapid brute-forcing of passwords. This combination of username enumeration and unrestricted password guessing significantly lowers the barrier for entry, allowing attackers to compromise administrative or standard user accounts without detection by traditional security monitoring tools that rely on detecting anomalous spikes in failed login attempts as indicators of compromise.
The impact of this vulnerability extends beyond simple account takeover. If an attacker successfully authenticates using weak or default credentials, they gain access to the AniWorld Downloader interface, which may provide control over download tasks, configuration settings, and potentially sensitive data associated with downloaded media files. In environments where the WebUI is exposed to untrusted networks, this can lead to broader system compromise if the underlying service runs with elevated privileges or has network connectivity that allows for further lateral movement. The vulnerability aligns with MITRE ATT&CK technique T1110.001, which describes Brute Force: Password Guessing, and highlights a common misconfiguration in web applications where authentication endpoints are not hardened against automated attacks.
To mitigate this risk, immediate action is required to upgrade AniWorld Downloader to version 5.3.0 or later, where these restrictions have presumably been implemented by the developers. For instances that cannot be immediately upgraded, administrators should implement network-level controls such as firewall rules to restrict access to the WebUI interface only from trusted IP addresses. Additionally, deploying a web application firewall with rate-limiting capabilities can help mitigate brute-force attempts by blocking sources that exceed a defined threshold of login requests within a specific time window. It is also critical to enforce strong password policies and consider implementing multi-factor authentication if supported by the platform or through external proxy solutions to add an additional layer of security against credential-based attacks.