CVE-2021-33563: Koel

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.

Affected products

• Koel Koel: before 5.1.4 (fixed in 5.1.4)

Published 2021-05-24. Last modified 2026-06-17.