org.apache.shiro:shiro-core vulnerabilities (Maven)

13 vulnerabilities.

• org.apache.shiro:shiro-core Maven Apache Shiro: Remember-me cookie isn't checked for expiry on the server CVE-2026-56130 Fix available 2.0 LowJune 25, 2026
• org.apache.shiro:shiro-core Maven Apache Shiro: LDAP DN Injection in DefaultLdapRealm CVE-2026-49268 Public exploitFix available 8.8 HighJune 17, 2026
• org.apache.shiro:shiro-core Maven Apache Shiro: Session fixation: new session is not created after login by default CVE-2026-43827 Fix available 5.9 MediumMay 25, 2026
• org.apache.shiro:shiro-core Maven Apache Shiro: Brute force attack possible to determine valid user names CVE-2026-23901 Fix available 1.0 LowFebruary 10, 2026
• org.apache.shiro:shiro-core Maven Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting CVE-2023-46749 Fix available 6.5 MediumJanuary 15, 2024
• org.apache.shiro:shiro-core Maven Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher CVE-2022-40664 Fix available 9.8 CriticalOctober 12, 2022
• org.apache.shiro:shiro-core Maven Authentication Bypass Vulnerability CVE-2022-32532 Public exploitFix available EPSS 25.5% 9.8 CriticalJune 28, 2022
• org.apache.shiro:shiro-core Maven Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass CVE-2021-41303 Fix available EPSS 76.1% 9.8 CriticalSeptember 17, 2021
• org.apache.shiro:shiro-core Maven Authentication bypass in Apache Shiro CVE-2020-13933 Public exploitFix available EPSS 44.4% 7.5 HighAugust 17, 2020
• org.apache.shiro:shiro-core Maven Improper Authentication in Apache Shiro CVE-2020-11989 Public exploitFix available EPSS 24.4% 9.8 CriticalJune 22, 2020
• org.apache.shiro:shiro-core Maven Improper Authentication in Apache Shiro CVE-2020-1957 Fix available EPSS 23.3% 9.8 CriticalMarch 25, 2020
• org.apache.shiro:shiro-core Maven Improper input validation in Apache Shiro CVE-2019-12422 Public exploitFix available 7.5 HighNovember 18, 2019
• org.apache.shiro:shiro-core Maven Improper Access Control in Apache Shiro CVE-2016-4437 In KEVPublic exploitFix available EPSS 93.0% 9.8 CriticalJune 7, 2016