org.apache.shiro:shiro-spring

3 results · Feed

• Medium 5.3
  CVE-2026-23903

  Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems

  Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served fro…

  Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  Feb 9, 2026
• Critical 9.8
  CVE-2020-17523 Public exploit EPSS 86%

  Authentication bypass in Apache Shiro

  Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

  org.apache.shiro:shiro-web org.apache.shiro:shiro-spring org.apache.shiro:shiro-spring-boot-starter Maven
  Feb 3, 2021
• Critical 9.8
  CVE-2020-17510

  Authentication bypass in Apache Shiro

  Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

  shiro shiro org.apache.shiro:shiro-spring Debian Ubuntu Maven
  Nov 5, 2020