CVE-2026-23903: Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
Impact
Authentication Bypass: A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).
The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting /SECRET.TXT to bypass a rule for /secret.txt).
This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.
Patches Users should upgrade to Apache Shiro 2.1.0 or later.
Important Configuration Note: Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:
shiro.ini: ini filterChainResolver.caseInsensitive = true Spring Boot (application.properties): properties shiro.caseInsensitive=true
Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.
Workarounds Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix). Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).
Resources CVE-2026-23903 Mailing List Announcement OSS-Security List
Other sources
Authentication Bypass by Alternate Name vulnerability in Apache Shiro.
This issue affects Apache Shiro: before 2.0.7.
Users are recommended to upgrade to version 2.0.7, which fixes the issue.
The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.
Shiro 2.0.7 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.propertie: shiro.caseInsensitive=true
Shiro 3.0.0 and later (upcoming) makes this the default.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.shiro:shiro-springto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 2.0.7 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 2.1.0 - Configuration
Enable Shiro case-insensitive handling by setting shiro.caseInsensitive=true in application.propertie/application.properties (as shown in the workaround) to remediate static-file authentication bypass on case-insensitive filesystems.
Apache Shiro (application.properties / shiro.caseInsensitive) shiro.caseInsensitive = true - Configuration
Enable case-insensitive filter chain resolution by setting filterChainResolver.caseInsensitive = true in application.properties (as shown) when static files are served from a case-insensitive filesystem.
Apache Shiro (application.properties / filterChainResolver.caseInsensitive) filterChainResolver.caseInsensitive = true - Configuration
In shiro.ini, set filterChainResolver.caseInsensitive = true (as shown) to ensure Shiro handles mixed-case protected static filenames on case-insensitive filesystems.
Apache Shiro (shiro.ini / filterChainResolver.caseInsensitive) filterChainResolver.caseInsensitive = true - Compensating control
Ensure the filesystem hosting the application is case-sensitive (e.g., Linux/Unix) to prevent authentication bypass for protected static files caused by filename capitalization differences on case-insensitive filesystems.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23903?
CVE-2026-23903 is classified as a critical vulnerability due to its potential for authentication bypass.
How do I fix CVE-2026-23903?
To mitigate CVE-2026-23903, upgrade Apache Shiro to version 2.1.0 or later.
Which versions of Apache Shiro are affected by CVE-2026-23903?
CVE-2026-23903 affects Apache Shiro versions prior to 2.0.7.
What impact does CVE-2026-23903 have on server security?
CVE-2026-23903 allows unauthenticated users to access sensitive static files on case-insensitive filesystems.
Is CVE-2026-23903 related to any specific filesystem type?
CVE-2026-23903 specifically affects case-insensitive filesystems, which increases the risk of authentication bypass.