CVE-2026-56091
Apache Shiro: Authentication bypass in Guice-Web integration
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Shiro: Authentication bypass in Guice-Web integration
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
CVE-2026-56091- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/V:D/RE:L/U:Amber - Weakness
- CWE-289
- Updated
- 2026-11-02
EUVDEUVD-2026-39230
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
EUVD-2026-39230- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/V:D/RE:L/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qj64-jj84-w38j
Apache Shiro shiro-guice module vulnerable to authentication bypass
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957, except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
GHSA-qj64-jj84-w38j- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/V:D/RE:L/U:Amber - Weakness
- CWE-289
- Updated
- 2026-11-03
NVD
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
CVE-2026-56091- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:D/RE:L/U:Amber - Weakness
- CWE-289
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module instead of the shiro-spring module. This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context. Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
DEBIAN-CVE-2026-56091- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:D/RE:L/U:Amber - Updated
- 2026-11-02
OSVGHSA-qj64-jj84-w38j
Apache Shiro shiro-guice module vulnerable to authentication bypass
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957, except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
GHSA-qj64-jj84-w38j- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/V:D/RE:L/U:Amber - Weakness
- CWE-289
- Updated
- 2026-11-03
OSVUBUNTU-CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module instead of the shiro-spring module. This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context. Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
UBUNTU-CVE-2026-56091- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/V:D/RE:L/U:Amber - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.shiro:shiro-guiceMaven |
2.0.0 up to 3.0.0 | 3.0.0 |
shiroDebian:12 |
All versions, plus listed versions 1.3.2-51.3.2-6 |
None known |
shiroDebian:13 |
All versions, plus listed versions 1.3.2-6 |
None known |
shiroDebian:14 |
All versions, plus listed versions 1.3.2-6 |
None known |
org.apache.shiro:shiro-guiceMaven |
2.0.0 up to 3.0.0, plus listed versions 2.0.12.0.22.0.32.0.42.0.5 Show 5 moreShow less2.0.62.1.02.2.02.2.13.0.0-alpha-1 |
3.0.0 |
shiroUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2 |
None known |
shiroUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.2-21.3.2-3~18.041.3.2-3~18.04.11.3.2-3ubuntu0.18.04.1~esm1 |
None known |
shiroUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-4ubuntu0.11.3.2-4ubuntu0.2 |
None known |
shiroUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-5 |
None known |
shiroUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.3.2-51.3.2-5ubuntu0.24.04.1~esm1 |
None known |
shiroUbuntu:25.10 |
All versions, plus listed versions 1.3.2-6ubuntu1 |
None known |
shiroUbuntu:26.10 |
All versions, plus listed versions 1.3.2-6ubuntu2 |
None known |
shiroUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.2-6ubuntu11.3.2-6ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, references | OSV | |
| affected, facts, references | GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-56091 is a high vulnerability (CVSS 8.2) in Apache Software Foundation Shiro, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. Fixed in org.apache.shiro:shiro-guice 3.0.0.
References
lists.apache.org/thread/onmtxmy2qonbpx7xlw3o34x8sctv47r7
nvd.nist.gov/vuln/detail/CVE-2026-56091
github.com/github/advisory-database/pull/10078
security-tracker.debian.org/tracker/CVE-2026-56091
ubuntu.com/security/CVE-2026-56091
cve.org/CVERecord?id=CVE-2026-56091