CVE-2026-23903: Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems

Published Feb 8, 2026
·
Updated

Impact

Authentication Bypass: A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).

The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting /SECRET.TXT to bypass a rule for /secret.txt).

This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.

Patches Users should upgrade to Apache Shiro 2.1.0 or later.

Important Configuration Note: Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:

shiro.ini: ini filterChainResolver.caseInsensitive = true Spring Boot (application.properties): properties shiro.caseInsensitive=true

Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.

Workarounds Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix). Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).

Resources CVE-2026-23903 Mailing List Announcement OSS-Security List

Other sources

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.

This issue affects Apache Shiro: before 2.0.7.

Users are recommended to upgrade to version 2.0.7, which fixes the issue.

The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.

Shiro 2.0.7 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.propertie: shiro.caseInsensitive=true

Shiro 3.0.0 and later (upcoming) makes this the default.

MITRE

Affected Software

5 affected componentsFixes available
Apache Shiro<2.0.7
Apache Shiro<2.0.7
maven/org.apache.shiro:shiro-spring<=2.0.6
2.1.0
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.7.2.1 - 9.7.2.11
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.6.1.1 - 9.6.1.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/org.apache.shiro:shiro-spring to a version that resolves this vulnerability.

    Fixed in 2.1.0
  2. Upgrade

    Upgrade Apache Shiro to a version that resolves this vulnerability.

    Fixed in 2.0.7
  3. Upgrade

    Upgrade Apache Shiro to a version that resolves this vulnerability.

    Fixed in 2.1.0
  4. Configuration

    Enable Shiro case-insensitive handling by setting shiro.caseInsensitive=true in application.propertie/application.properties (as shown in the workaround) to remediate static-file authentication bypass on case-insensitive filesystems.

    Apache Shiro (application.properties / shiro.caseInsensitive) shiro.caseInsensitive = true
  5. Configuration

    Enable case-insensitive filter chain resolution by setting filterChainResolver.caseInsensitive = true in application.properties (as shown) when static files are served from a case-insensitive filesystem.

    Apache Shiro (application.properties / filterChainResolver.caseInsensitive) filterChainResolver.caseInsensitive = true
  6. Configuration

    In shiro.ini, set filterChainResolver.caseInsensitive = true (as shown) to ensure Shiro handles mixed-case protected static filenames on case-insensitive filesystems.

    Apache Shiro (shiro.ini / filterChainResolver.caseInsensitive) filterChainResolver.caseInsensitive = true
  7. Compensating control

    Ensure the filesystem hosting the application is case-sensitive (e.g., Linux/Unix) to prevent authentication bypass for protected static files caused by filename capitalization differences on case-insensitive filesystems.

Event History

Feb 9, 2026
CVE Published
via MITRE·09:26 AM
Data Sourced
via MITRE·09:26 AM
DescriptionWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·12:30 PM
Data Sourced
via GitHub·12:30 PM
DescriptionSeverityWeaknessAffected Software
Jul 6, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-23903?

CVE-2026-23903 is classified as a critical vulnerability due to its potential for authentication bypass.

2

How do I fix CVE-2026-23903?

To mitigate CVE-2026-23903, upgrade Apache Shiro to version 2.1.0 or later.

3

Which versions of Apache Shiro are affected by CVE-2026-23903?

CVE-2026-23903 affects Apache Shiro versions prior to 2.0.7.

4

What impact does CVE-2026-23903 have on server security?

CVE-2026-23903 allows unauthenticated users to access sensitive static files on case-insensitive filesystems.

5

Is CVE-2026-23903 related to any specific filesystem type?

CVE-2026-23903 specifically affects case-insensitive filesystems, which increases the risk of authentication bypass.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203