The vulnerability is an improper restriction of authentication attempts in the WebUI /login POST handler. Without throttling, unauthenticated attackers can brute‑force passwords and use response timing to enumerate valid usernames, potentially taking over user accounts. The weakness stems from missing rate limiting and user enumeration controls (CWE‑307).

The flaw affects PhoenixThrush's AniWorld Downloader software versions earlier than 5.3.0 through the web interface. Any deployment that exposes the /login endpoint is susceptible.

The CVSS score of 6.9 indicates a moderate risk level. EPSS information is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers can reach the /login endpoint over the internet or on internal networks, and because no throttling or blocking is in place, the likelihood of a successful brute‑force attack is high. Existing authentication controls are bypassed entirely, leading to account takeover.