{"id":"CVE-2023-2106","aliases":["GHSA-mhmp-m6g7-7c24","PYSEC-2026-1233"],"title":"Weak Password Requirements in calibreweb","summary":"Weak Password Requirements in calibreweb","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","vendor":"calibreweb","product":"calibreweb","ecosystem":"pip","affected":["calibreweb < 0.6.20"],"patched":["calibreweb 0.6.20"],"published":"2023-04-15","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mhmp-m6g7-7c24","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2106"},{"url":"https://github.com/janeczku/calibre-web/commit/49e4f540c9b204c7e39b3c27ceadecd83ed60e7e"},{"url":"https://github.com/janeczku/calibre-web"},{"url":"https://huntr.dev/bounties/c3d5c647-7557-40a9-aee4-24dc14882781"}],"tags":["osv","pip"],"epss":0.00748,"epssPercentile":0.52948,"ingestedAt":"2026-07-08T18:25:51.225Z","slug":"CVE-2023-2106","body":"## Overview\n\nWeak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.\n\n## Affected packages\n\n- `calibreweb < 0.6.20`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `calibreweb 0.6.20`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}