CVE-2023-34478
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Risk Assessment
Organizations may be exposed to unauthorized access to resources, potentially leading to serious security breaches.
Recommendation
It is recommended to update to Apache Shiro version 1.12.0 or later, or 2.0.0-alpha-3 or later.
Other vulnerabilities in Apache Shiro
See all- CVE-2016-6802High
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
- CVE-2014-0074High
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty username or password.
- CVE-2026-49268Critical
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping, allowing manipulation of the DN structure used for LDAP bind authentication.
- CVE-2026-58301Medium
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Upgrade to version 3.0.1 or later fixes the issue. Alternatively, set the org.apache.shiro.form-resubmit-host and org.apache.shiro.form-resubmit-port system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
- CVE-2026-48589Medium
The Jakarta EE module in Apache Shiro (versions 2.0-alpha to 2.2.0 and 3.0.0-alpha-1) uses the HTTP Referer header for redirect after login. Insufficient validation of this client-controlled header could allow an attacker to influence the redirect target.
- CVE-2026-44598Medium
Apache Shiro versions 2.0-alpha to 2.1.0 and 3.0.0-alpha-1, when using the shiro-jakarta-ee module, are vulnerable to Open Redirect and SSRF. After login, the shiroSavedRequest cookie was not validated, allowing redirect to arbitrary URLs and server-side GET requests.
- CVE-2026-43828Medium
Default configurations of Apache Shiro send sensitive cookies (JSESSIONID and rememberMe) in HTTPS sessions without the 'Secure' attribute. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. Fixed in 2.1.1 and 3.0.0-alpha-2.
- CVE-2026-43827Medium
Default configurations of Apache Shiro have a session fixation vulnerability. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. In affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session generated with a new ID. Users are recommended to upgrade to version 2.1.1 or 3.0.0-alpha-2.
- CVE-2026-23903Medium
Vulnerability in Apache Shiro allows authentication bypass by varying the case of filenames in requests for static files. If static files are served from a case-insensitive filesystem (e.g., default macOS), an attacker can access files not covered by Shiro filters. Affects versions before 2.0.7.
Original NVD description (English source)
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+