Skip to content
fr Sign in
Not rated

CVE-2026-23903 Authentication Bypass by Alternate Name vulnerability in Apache Shiro

Description

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Affected products and versions

Product Affected versions Fixed in
Apache Shiro 2.0 earliest → < 2.0.7 2.0.7

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Shiro

The 17 CVEs of Apache Shiro →
CVE-2026-58301 When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that… 5.9 Medium CVE-2026-56091 When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause… 8.2 High CVE-2026-56130 "Remember me" cookie age is not verified on the server 2.0 Low CVE-2026-49268 A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm… 8.8 High
Track this CVE