CVE-2014-0074
HighSummary
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty username or password.
Risk Assessment
The organization may be exposed to unauthorized access to systems, potentially leading to data breaches or other serious security incidents.
Recommendation
It is recommended to upgrade Apache Shiro to version 1.2.3 or later and disable unauthenticated bind in the LDAP server configuration.
Other vulnerabilities in Apache Shiro
See all- CVE-2016-6802High
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
- CVE-2026-49268Critical
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping, allowing manipulation of the DN structure used for LDAP bind authentication.
- CVE-2023-34478Critical
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
- CVE-2026-48589Medium
The Jakarta EE module in Apache Shiro (versions 2.0-alpha to 2.2.0 and 3.0.0-alpha-1) uses the HTTP Referer header for redirect after login. Insufficient validation of this client-controlled header could allow an attacker to influence the redirect target.
- CVE-2026-44598Medium
Apache Shiro versions 2.0-alpha to 2.1.0 and 3.0.0-alpha-1, when using the shiro-jakarta-ee module, are vulnerable to Open Redirect and SSRF. After login, the shiroSavedRequest cookie was not validated, allowing redirect to arbitrary URLs and server-side GET requests.
- CVE-2026-43828Medium
Default configurations of Apache Shiro send sensitive cookies (JSESSIONID and rememberMe) in HTTPS sessions without the 'Secure' attribute. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. Fixed in 2.1.1 and 3.0.0-alpha-2.
- CVE-2026-43827Medium
Default configurations of Apache Shiro have a session fixation vulnerability. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. In affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session generated with a new ID. Users are recommended to upgrade to version 2.1.1 or 3.0.0-alpha-2.
- CVE-2026-23903Medium
Vulnerability in Apache Shiro allows authentication bypass by varying the case of filenames in requests for static files. If static files are served from a case-insensitive filesystem (e.g., default macOS), an attacker can access files not covered by Shiro filters. Affects versions before 2.0.7.
Original NVD description (English source)
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.