An authentication bypass vulnerability in Shiori 1.6.0 and 1.6.1 allows unauthorized access due to incomplete security logic in v1 API endpoints.

The vulnerability exists in the CheckToken function, where new v1 API endpoints were exposed with incomplete security controls. This allows an attacker to bypass standard authentication requirements.

With a CVSS score of 8.2, this vulnerability poses a significant risk of unauthorized access to the Shiori instance. An attacker could potentially access, modify, or delete bookmarked content or other sensitive data stored within the application, leading to a loss of data integrity and confidentiality.

Immediate Action: Upgrade all instances of Shiori to version 1.6.2 or later to resolve the authentication logic flaw.

Proactive Monitoring: Review application access logs for unusual patterns or access attempts to v1 API endpoints by unauthorized accounts.

Compensating Controls: Place the Shiori application behind a VPN or reverse proxy that requires secondary authentication before reaching the application layer.

Public Exploit Available: False

Users of the Shiori bookmarking application should update to version 1.6.2 immediately. The presence of an authentication bypass in an application designed to store user data necessitates prompt attention to maintain the security of the bookmarking environment.