1.0
Low
CVE-2026-23901 Observable Timing Discrepancy vulnerability in Apache Shiro
Description
Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Shiro 2.0 | earliest → < 2.0.7 | 2.0.7 |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Shiro
The 17 CVEs of Apache Shiro →
CVE-2026-58301
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that…
5.9
Medium
CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause…
8.2
High
CVE-2026-56130
"Remember me" cookie age is not verified on the server
2.0
Low
CVE-2026-49268
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm…
8.8
High