Severity:
Affected versions:
- Apache Shiro (org.apache.shiro:shiro-core) through 2.2.0 - Apache Shiro (org.apache.shiro:shiro-core) 3.0.0-alpha-0 through 3.0.0-alpha-1
Description:
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
Credit:
zhaokaifei (reporter) - ChinaTelecom (finder) Lenny Primak <lenny () flowlogix com> (remediation developer)
References:
https://shiro.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-49268
Severity:
Affected versions:
- Apache Shiro (org.apache.shiro:shiro-core) 1.0 through 2.1.0 - Apache Shiro (org.apache.shiro:shiro-core) 3.0.0-alpha-0 through 3.0.0-alpha-1
Description:
Default configurations of Apache Shiro have a session fixation vulnerability.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.
Credit:
Rasmus Moorats <xx () nns ee> (finder) Lenny Primak <lenny () flowlogix com> (remediation developer)
References:
https://shiro.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-43827
Severity: low
Affected versions:
- Apache Shiro (org.apache.shiro:shiro-core) before 2.0.7
Description:
Observable Timing Discrepancy vulnerability in Apache Shiro.
This issue affects Apache Shiro: from 1., 2. before 2.0.7.
Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.
Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.
The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#usernameenumeration discusses this as well.
Typically, brute force attack can be mitigated at the infrastructure level.
Credit:
4ra1n (finder) Y4tacker (finder) lprimak (remediation developer)
References:
https://shiro.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-23901