Every CVE Search/ Get API key

CVE-2026-23903

Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems

5.3 MediumFix available

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true

Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.40%Up 0.4 points since Feb 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true

Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Record
CVE-2026-23903
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-289
Updated
2026-11-02
EUVDEUVD-2026-6903 5.3

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true

Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Record
EUVD-2026-6903
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-c244-p6m5-vqj6 5.3

Apache Shiro has an Authentication Bypass

Impact

Authentication Bypass: A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).

The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting /SECRET.TXT to bypass a rule for /secret.txt).

This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.

Patches

Users should upgrade to Apache Shiro 2.1.0 or later.

Important Configuration Note: Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:

  • shiro.ini: 
    filterChainResolver.caseInsensitive = true
  • Spring Boot (application.properties): 
    shiro.caseInsensitive=true

Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.

Workarounds

  • Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix).
  • Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).

Resources

Record
GHSA-c244-p6m5-vqj6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-289
Updated
2026-11-02
NVD 5.3

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true

Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Record
CVE-2026-23903
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-289
Updated
2026-11-02
OSV 5.3

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.0.7 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.propertie: shiro.caseInsensitive=true

Shiro 3.0.0 and later (upcoming) makes this the default.

Record
CVE-2026-23903
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2026-23903 5.3

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Record
DEBIAN-CVE-2026-23903
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVGHSA-c244-p6m5-vqj6 5.3

Apache Shiro has an Authentication Bypass

Impact

Authentication Bypass: A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).

The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting /SECRET.TXT to bypass a rule for /secret.txt).

This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.

Patches

Users should upgrade to Apache Shiro 2.1.0 or later.

Important Configuration Note: Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:

  • shiro.ini: 
    filterChainResolver.caseInsensitive = true
  • Spring Boot (application.properties): 
    shiro.caseInsensitive=true

Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.

Workarounds

  • Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix).
  • Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).

Resources

Record
GHSA-c244-p6m5-vqj6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-289
Updated
2026-11-02
OSVUBUNTU-CVE-2026-23903 5.3

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Record
UBUNTU-CVE-2026-23903
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.shiro:shiro-spring
Maven
 through 2.0.6
2.1.0
shiro
Debian:12
 All versions, plus listed versions
1.3.2-51.3.2-6
 None known
shiro
Debian:13
 All versions, plus listed versions
1.3.2-6
 None known
shiro
Debian:14
 All versions, plus listed versions
1.3.2-6
 None known
org.apache.shiro:shiro-spring
Maven
 before 2.1.0, plus listed versions
1.0.0-incubating1.1.01.10.01.10.11.11.0
Show 37 moreShow less
1.12.01.13.01.2.01.2.11.2.21.2.31.2.41.2.51.2.61.3.01.3.11.3.21.4.01.4.0-RC21.4.11.4.21.5.01.5.11.5.21.5.31.6.01.7.01.7.11.8.01.9.01.9.12.0.02.0.0-alpha-12.0.0-alpha-22.0.0-alpha-32.0.0-alpha-42.0.12.0.22.0.32.0.42.0.52.0.6
2.1.0
shiro
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2
 None known
shiro
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.3.2-21.3.2-3~18.041.3.2-3~18.04.11.3.2-3ubuntu0.18.04.1~esm1
 None known
shiro
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.3.2-41.3.2-4ubuntu0.11.3.2-4ubuntu0.2
 None known
shiro
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.3.2-41.3.2-5
 None known
shiro
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.3.2-51.3.2-5ubuntu0.24.04.1~esm1
 None known
shiro
Ubuntu:25.10
 All versions, plus listed versions
1.3.2-6ubuntu1
 None known
shiro
Ubuntu:26.10
 All versions, plus listed versions
1.3.2-6ubuntu2
 None known
shiro
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.3.2-6ubuntu11.3.2-6ubuntu2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-23903 is a medium vulnerability (CVSS 5.3) in Apache Shiro, published February 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in org.apache.shiro:shiro-spring 2.1.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open