Skip to content
Apache Shiro vulnerabilities
-
apache shiro
Apache Shiro: Server-side POST request may be steered to an alternate host
CVE-2026-58301
5.9 Medium
-
apache shiro
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
CVE-2026-49268
Public exploitFix available
8.8 High
-
apache shiro
Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
CVE-2026-48589
Fix available
0.0 None
-
apache shiro, apache software foundation shiro jakarta ee module +1 more
Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
CVE-2026-44598
Fix available
5.1 Medium
-
apache shiro
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
CVE-2026-43828
Fix available
5.9 Medium
-
apache shiro
Apache Shiro: Session fixation: new session is not created after login by default
CVE-2026-43827
Fix available
5.9 Medium
-
apache shiro
Apache Shiro: Brute force attack possible to determine valid user names
CVE-2026-23901
Fix available
1.0 Low
-
apache shiro
Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
CVE-2026-23903
Fix available
5.3 Medium
-
apache shiro
Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
CVE-2023-46749
Fix available
6.5 Medium
-
apache shiro
Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.
CVE-2023-46750
Fix available
6.1 Medium
-
apache shiro
Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.
CVE-2023-34478
Public exploitFix available
9.8 Critical
-
apache shiro, vmware spring boot +1 more
Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request
CVE-2023-22602
Fix available
7.5 High
-
apache shiro
Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
CVE-2022-40664
Fix available
9.8 Critical
-
apache shiro
Authentication Bypass Vulnerability
CVE-2022-32532
Public exploitFix available
EPSS 25.5%
9.8 Critical
-
apache shiro, oracle financial services crime and compliance management studio +1 more
Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass
CVE-2021-41303
Fix available
EPSS 76.1%
9.8 Critical
-
apache shiro
Authentication bypass in Apache Shiro
CVE-2020-17523
Public exploitFix available
EPSS 85.9%
9.8 Critical
-
apache shiro, debian linux +1 more
Authentication bypass in Apache Shiro
CVE-2020-17510
Fix available
9.8 Critical
-
apache shiro, debian linux +1 more
Authentication bypass in Apache Shiro
CVE-2020-13933
Public exploitFix available
EPSS 44.4%
7.5 High
-
apache shiro
Improper Authentication in Apache Shiro
CVE-2020-11989
Public exploitFix available
EPSS 24.4%
9.8 Critical
-
apache shiro, debian linux +1 more
Improper Authentication in Apache Shiro
CVE-2020-1957
Fix available
EPSS 23.3%
9.8 Critical
-
apache shiro
Improper input validation in Apache Shiro
CVE-2019-12422
Public exploitFix available
7.5 High
-
apache shiro
Improper Access Control in Apache Shiro
CVE-2016-6802
Fix available
7.5 High
-
apache shiro, aurora, redhat fuse +1 more +3 more
Improper Access Control in Apache Shiro
CVE-2016-4437
In KEVPublic exploitFix available
EPSS 93.0%
9.8 Critical
-
apache shiro
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled,...
CVE-2014-0074
Fix available
7.5 High
-
apache shiro, jsecurity +1 more
Apache Shiro Path Traversal vulnerability
CVE-2010-3863
Public exploitFix available
EPSS 54.5%
5.0 Medium