CVE-2026-23903: Apache Shiro Authentication Bypass Vulnerability
Summary
CVE-2026-23903: Apache Shiro has an Authentication Bypass. Affects org.apache.shiro:shiro-spring versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Shiro is a powerful and flexible open-source security framework that provides authentication, authorization, cryptography, and session management capabilities for Java applications. It is widely used for securing web applications and services. However, a vulnerability has been identified that allows attackers to bypass authentication for static files when served from case-insensitive filesystems, such as those commonly found on macOS and Windows.
Vulnerability Detail
The vulnerability arises from Apache Shiro's URL filters being configured with lower-case rules while the underlying operating system treats mixed-case filenames as identical. This allows attackers to access protected static resources by varying the capitalization of the filename in the request. For example, an attacker could request '/SECRET.TXT' to bypass a rule set for '/secret.txt'. This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider the following workarounds:
- Ensure that the filesystem hosting the application is case-sensitive (e.g., using Linux/Unix).
- Manually configure all Shiro filter chains to handle all possible case variations of protected filenames, though this is not recommended due to its complexity.
Conclusion
In summary, CVE-2026-23903 is a significant vulnerability in Apache Shiro that allows for authentication bypass on case-insensitive filesystems. Users are advised to upgrade to version 2.1.0 or later and configure their applications accordingly to mitigate this risk.
See every vulnerability recorded for org.apache.shiro:shiro-spring →
FAQ
CVE-2026-23903 is a vulnerability in Apache Shiro that allows authentication bypass for static files on case-insensitive filesystems.
If your application uses Apache Shiro and is hosted on a case-insensitive filesystem, attackers may gain unauthorized access to protected static resources.
Versions of Apache Shiro prior to 2.1.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application using the Vulert playground without signing up.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shiro:shiro-spring.
