CVE-2020-13933: Authentication bypass in Apache Shiro
Summary
CVE-2020-13933: Authentication bypass in Apache Shiro. Affects org.apache.shiro:shiro-core versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Also tracked for
- shiro · Debian:11
The same CVE-2020-13933 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Shiro is a powerful and easy-to-use Java security framework that provides authentication, authorization, cryptography, and session management capabilities. It is widely used in Java applications to secure sensitive data and control access to resources. However, a vulnerability has been discovered in Apache Shiro versions prior to 1.6.0 that allows for an authentication bypass. This means that a specially crafted HTTP request can bypass the authentication process, potentially granting unauthorized access to protected resources.
Vulnerability Detail
The vulnerability (CVE-2020-13933) in Apache Shiro arises from a flaw in the authentication mechanism. By sending a specially crafted HTTP request, an attacker can exploit this flaw to bypass the authentication process. This can lead to unauthorized access to sensitive resources and compromise the security of the application. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of Apache Shiro to ensure the security of your application.
Conclusion
The authentication bypass vulnerability in Apache Shiro can have serious security implications for applications using this framework. It is crucial to upgrade to the fixed version (1.6.0 or later) to mitigate the risk of unauthorized access. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.shiro:shiro-core →
FAQ
Apache Shiro is a Java security framework that provides authentication, authorization, cryptography, and session management capabilities.
The vulnerability allows for an authentication bypass, potentially granting unauthorized access to protected resources.
Upgrade to Apache Shiro version 1.6.0 or later to fix this vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is necessary.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shiro:shiro-core.
