id: PYSEC-2026-1231
published: "2026-07-07T11:45:18.433911Z"
modified: "2026-07-07T17:23:52.769608Z"
aliases:
- CVE-2022-2525
- GHSA-jg8w-wgx2-g7q4
summary: Improper Restriction of Excessive Authentication Attempts in calibreweb
details: Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
affected:
- package:
    name: calibreweb
    ecosystem: PyPI
    purl: pkg:pypi/calibreweb
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.6.20
  versions:
  - 0.6.12
  - 0.6.13
  - 0.6.14
  - 0.6.15
  - 0.6.16
  - 0.6.17
  - 0.6.18
  - 0.6.19
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2022-2525
- type: WEB
  url: https://github.com/janeczku/calibre-web/commit/49e4f540c9b204c7e39b3c27ceadecd83ed60e7e
- type: WEB
  url: https://huntr.dev/bounties/9ff87820-c14c-4454-9764-406496254ef0
- type: PACKAGE
  url: https://pypi.org/project/calibreweb
- type: ADVISORY
  url: https://github.com/advisories/GHSA-jg8w-wgx2-g7q4