HIGH

GHSA-r37h-j483-cjjm

Improper rate limiting in Koel

Quick fix

GHSA-r37h-j483-cjjm — phanan/koel: upgrade to the fixed version with the command below.

composer require phanan/koel:^5.1.4

Details

Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/phanan/koel

Introduced in: 0Fixed in: 5.1.4

Fixcomposer require phanan/koel:^5.1.4

References

https://nvd.nist.gov/vuln/detail/CVE-2021-33563[ADVISORY]
https://github.com/koel/koel/releases/tag/v5.1.4[WEB]
https://huntr.dev/bounties/1-other-koel/koel[WEB]