CVE-2026-23901: Apache Shiro Observable Timing Discrepancy Vulnerability
Summary
CVE-2026-23901: Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability. Affects org.apache.shiro:shiro-core versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Shiro is a powerful and flexible open-source security framework that provides authentication, authorization, cryptography, and session management for Java applications. It is widely used for securing applications due to its ease of integration and comprehensive security features. However, certain versions of Apache Shiro are vulnerable to an observable timing discrepancy that can be exploited by attackers.
Vulnerability Detail
The observable timing discrepancy vulnerability in Apache Shiro arises from differing code paths for non-existent users versus existing users. This discrepancy allows an attacker to perform a brute-force attack by timing requests to determine whether a user exists or if the failure was due to an incorrect password. The vulnerability affects versions of Apache Shiro from 1.* and 2.* before 2.0.7, making it possible for attackers to enumerate valid usernames through timing analysis.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While the best solution is to upgrade to the patched version, a potential workaround is to implement rate limiting on authentication attempts at the infrastructure level to mitigate brute-force attacks.
Conclusion
The observable timing discrepancy vulnerability in Apache Shiro poses a risk of user enumeration through timing attacks. Users are strongly advised to upgrade to version 2.0.7 or later to secure their applications. Implementing rate limiting can serve as a temporary mitigation strategy.
See every vulnerability recorded for org.apache.shiro:shiro-core →
FAQ
The CVSS score of this vulnerability is 1.0, indicating a low severity.
Apache Shiro versions from 1.* and 2.* before 2.0.7 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to user enumeration, allowing attackers to identify valid usernames and potentially launch further attacks.
Yes, implementing rate limiting on authentication attempts can help mitigate the risk of brute-force attacks.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shiro:shiro-core.
