CVE-2026-108580 phoenixthrush CVE debrief

Who should care

Defenders responsible for AniWorld Downloader deployments should assess exposure and prioritize upgrading to version 5.3.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, plan for upgrades or mitigations, and review compensating controls for exposed systems.

Why it matters

CVE-2026-108580 allows unauthenticated attackers to guess passwords without throttling in AniWorld Downloader before 5.3.0, impacting defenders responsible for deployments.

• Unauthenticated attackers can enumerate usernames through verify_user response timing
• Unauthenticated attackers can brute-force passwords on exposed WebUI instances to take over accounts
• Defenders need to verify exposure of AniWorld Downloader WebUI instances
• Defenders need to prioritize upgrading to version 5.3.0 or later

Technical summary

The AniWorld Downloader WebUI /login POST handler does not properly restrict authentication attempts, allowing unauthenticated attackers to guess passwords without throttling. This vulnerability impacts AniWorld Downloader deployments, enabling attackers to enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances. Defenders should prioritize verifying exposure of AniWorld Downloader WebUI instances and upgrading to version 5.3.0 or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of AniWorld Downloader WebUI instances and upgrading to version 5.3.0 or later.

Recommended defensive actions

• Verify exposure of AniWorld Downloader WebUI instances
• Upgrade to version 5.3.0 or later
• Monitor for suspicious login attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows unauthenticated attackers to enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts. This is possible due to the lack of throttling on authentication attempts in the WebUI /login POST handler of AniWorld Downloader before 5.3.0. Defenders should verify exposure of AniWorld Downloader WebUI instances and prioritize upgrading to version 5.3.0 or later. Evidence is based on the CVE record and source-specific vulnerability assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.