Apache Software Foundation Shiro vulnerabilities

• apache shiro Apache Shiro: Server-side POST request may be steered to an alternate host CVE-2026-58301 5.9 MediumAugust 31, 2026
• apache software foundation shiro Apache Shiro: Authentication bypass in Guice-Web integration CVE-2026-56091 Fix available 8.2 HighJune 25, 2026
• apache software foundation shiro Apache Shiro: Remember-me cookie isn't checked for expiry on the server CVE-2026-56130 Fix available 2.0 LowJune 25, 2026
• apache shiro Apache Shiro: LDAP DN Injection in DefaultLdapRealm CVE-2026-49268 Public exploitFix available 8.8 HighJune 17, 2026
• apache shiro Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow CVE-2026-48589 Fix available 0.0 NoneMay 25, 2026
• apache shiro, apache software foundation shiro jakarta ee module +1 more Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials) CVE-2026-44598 Fix available 5.1 MediumMay 25, 2026
• apache shiro Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default CVE-2026-43828 Fix available 5.9 MediumMay 25, 2026
• apache shiro Apache Shiro: Session fixation: new session is not created after login by default CVE-2026-43827 Fix available 5.9 MediumMay 25, 2026
• apache shiro Apache Shiro: Brute force attack possible to determine valid user names CVE-2026-23901 Fix available 1.0 LowFebruary 10, 2026
• apache shiro Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems CVE-2026-23903 Fix available 5.3 MediumFebruary 9, 2026
• apache shiro Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting CVE-2023-46749 Fix available 6.5 MediumJanuary 15, 2024
• apache shiro Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro. CVE-2023-46750 Fix available 6.1 MediumDecember 14, 2023
• apache shiro Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests. CVE-2023-34478 Public exploitFix available 9.8 CriticalJuly 24, 2023
• apache shiro, vmware spring boot +1 more Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request CVE-2023-22602 Fix available 7.5 HighJanuary 14, 2023
• apache shiro Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher CVE-2022-40664 Fix available 9.8 CriticalOctober 12, 2022
• apache shiro Authentication Bypass Vulnerability CVE-2022-32532 Public exploitFix available EPSS 25.5% 9.8 CriticalJune 28, 2022
• apache shiro, oracle financial services crime and compliance management studio +1 more Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass CVE-2021-41303 Fix available EPSS 76.1% 9.8 CriticalSeptember 17, 2021
• apache shiro Authentication bypass in Apache Shiro CVE-2020-17523 Public exploitFix available EPSS 85.9% 9.8 CriticalFebruary 3, 2021
• apache shiro, debian linux +1 more Authentication bypass in Apache Shiro CVE-2020-17510 Fix available 9.8 CriticalNovember 5, 2020
• apache shiro, debian linux +1 more Authentication bypass in Apache Shiro CVE-2020-13933 Public exploitFix available EPSS 44.4% 7.5 HighAugust 17, 2020
• apache shiro Improper Authentication in Apache Shiro CVE-2020-11989 Public exploitFix available EPSS 24.4% 9.8 CriticalJune 22, 2020
• apache shiro, debian linux +1 more Improper Authentication in Apache Shiro CVE-2020-1957 Fix available EPSS 23.3% 9.8 CriticalMarch 25, 2020