CVE-2026-23903
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vulnerability in Apache Shiro allows authentication bypass by varying the case of filenames in requests for static files. If static files are served from a case-insensitive filesystem (e.g., default macOS), an attacker can access files not covered by Shiro filters. Affects versions before 2.0.7.
Risk Assessment
The organization may be exposed to unauthorized access to static files that should be protected, potentially leading to data leakage or integrity compromise.
Recommendation
Upgrade to version 2.0.7 or later. In versions 2.1.0+ enable caseInsensitive mode, and in 3.0.1+ it is default.
Other vulnerabilities in Apache Shiro
See all- CVE-2016-6802High
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
- CVE-2014-0074High
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty username or password.
- CVE-2026-49268Critical
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping, allowing manipulation of the DN structure used for LDAP bind authentication.
- CVE-2023-34478Critical
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
- CVE-2026-48589Medium
The Jakarta EE module in Apache Shiro (versions 2.0-alpha to 2.2.0 and 3.0.0-alpha-1) uses the HTTP Referer header for redirect after login. Insufficient validation of this client-controlled header could allow an attacker to influence the redirect target.
- CVE-2026-44598Medium
Apache Shiro versions 2.0-alpha to 2.1.0 and 3.0.0-alpha-1, when using the shiro-jakarta-ee module, are vulnerable to Open Redirect and SSRF. After login, the shiroSavedRequest cookie was not validated, allowing redirect to arbitrary URLs and server-side GET requests.
- CVE-2026-43828Medium
Default configurations of Apache Shiro send sensitive cookies (JSESSIONID and rememberMe) in HTTPS sessions without the 'Secure' attribute. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. Fixed in 2.1.1 and 3.0.0-alpha-2.
- CVE-2026-43827Medium
Default configurations of Apache Shiro have a session fixation vulnerability. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. In affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session generated with a new ID. Users are recommended to upgrade to version 2.1.1 or 3.0.0-alpha-2.
Original NVD description (English source)
Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.