CVE-2026-23901: Apache Shiro: Brute force attack possible to determine valid user names
Observable Timing Discrepancy vulnerability in Apache Shiro.
This issue affects Apache Shiro: from 1., 2. before 2.0.7.
Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.
Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.
The most likely attack vector is a local attack only. Shiro security model
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.shiro:shiro-coreto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 2.0.7 - Compensating control
Mitigate brute-force timing/user-name enumeration attacks at the infrastructure level (e.g., apply infrastructure controls since the issue notes the most likely attack vector is a local attack only).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23901?
CVE-2026-23901 is classified as a high severity vulnerability due to its potential to allow brute force attacks on valid usernames.
How do I fix CVE-2026-23901?
To fix CVE-2026-23901, upgrade Apache Shiro to version 2.0.7 or later.
What versions of Apache Shiro are affected by CVE-2026-23901?
CVE-2026-23901 affects Apache Shiro versions 1.* and 2.* prior to 2.0.7.
What type of attack does CVE-2026-23901 enable?
CVE-2026-23901 enables brute force attacks to determine valid usernames through observable timing discrepancies.
Can I mitigate CVE-2026-23901 without upgrading?
Mitigation without upgrading is limited, but implementing account lockout mechanisms may help reduce exposure to brute force attempts.