Apache Shiro (Apache Software Foundation) - vulnerabilities (CVEs)
17 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-08-31. Vendor: Apache Software Foundation.
CVEs of Apache Shiro
- CVE-2026-58301 - CVSS 6.5 (medium), 2026-08-31: When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a…
- CVE-2026-56091 - CVSS 8.2 (high), 2026-06-25: When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This…
- CVE-2026-56130 - CVSS 2 (low), 2026-06-25: "Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after…
- CVE-2026-49268 - CVSS 9.1 (critical), 2026-06-17: A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is…
- CVE-2026-48589 - CVSS 5.4 (medium), 2026-05-25: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient…
- CVE-2026-43828 - CVSS 6.5 (medium), 2026-05-25: Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0,…
- CVE-2026-43827 - CVSS 6.5 (medium), 2026-05-25: Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are…
- CVE-2026-23901 - CVSS 2.5 (low), 2026-02-10: Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to…
- CVE-2026-23903 - CVSS 5.3 (medium), 2026-02-09: Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to…
- CVE-2023-46749 - CVSS 6.5 (medium), 2024-01-15: Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with…
- CVE-2023-46750 - CVSS 6.1 (medium), 2023-12-14: URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro…
- CVE-2023-34478 - CVSS 9.8 (critical), 2023-07-24: Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with…
- CVE-2023-22602 - CVSS 7.5 (high), 2023-01-14: When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication…
- CVE-2022-40664 - CVSS 9.8 (critical), 2022-10-12: Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
- CVE-2022-32532 - CVSS 9.8 (critical), 2022-06-29: Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with…
- CVE-2021-41303 - CVSS 9.8 (critical), 2021-09-17: Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update…
- CVE-2020-11989 - CVSS 9.8 (critical), 2020-06-22: Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
