Executive brief
Apache Shiro, a widely used security framework for Java applications, contains a flaw in its shiro-guice module. An attacker can bypass authentication requirements by sending a specially crafted web request, potentially gaining unauthorized access to protected areas of an application. This could lead to the exposure of sensitive data or unauthorized administrative actions.
Technical details
An authentication bypass vulnerability exists in Apache Shiro when using the shiro-guice module within a web servlet context. The flaw is rooted in how the module processes specific HTTP request patterns, similar to previous path-traversal or normalization issues seen in other Shiro modules (e.g., CVE-2020-1957). A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request to bypass security filters and access protected endpoints. This issue affects all versions through 2.x and version 3.0.0-alpha-1. Users should upgrade to Apache Shiro 3.0.0 or later to remediate the vulnerability.
Affected products
- Apache Software Foundation Apache Shiro All versions through 2.x, 3.0.0-alpha-1
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory