CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled
Published Nov 14, 2026
·Updated
Affected Software
4 affected components
debian/shiro*
debian/shiro*
debian/shiro*
debian/shiro<=1.3.2-5, <=1.3.2-6
Frequently Asked Questions
1
Which deployments are affected?
Deployments using Apache Shiro's DefaultLdapRealm with authentication caching enabled are affected.