Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Shiro

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-56091

    Apache Shiro: Authentication bypass in Guice-Web integration

    When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , …

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • High 8.8
    CVE-2026-49268 Public exploit

    Apache Shiro: LDAP DN Injection in DefaultLdapRealm

    A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. …

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • High 7.5
    CVE-2023-22602

    Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request

    When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro …

    Apache Software Foundation Apache Shiro shiro org.apache.shiro:shiro-root Debian Maven