Apache Software Foundation Apache Shiro
17 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-58301 | 2.0.0-alpha-0 – 3.0.0 | Apache Shiro: Server-side POST request may be steered to an alternate host | MEDIUM 5.9 | 0.5 % | ||
| CVE-2026-56091 | ≤ 2.99.99 ; 3.0.0-alpha-0 – 3.0.0-alpha-1 | Apache Shiro: Authentication bypass in Guice-Web integration | HIGH 8.2 | 0.7 % | ||
| CVE-2026-56130 | 1.2.4 – 2.99.99 ; 3.0.0-alpha-0 – 3.0.0-alpha-1 | Apache Shiro: Remember-me cookie isn't checked for expiry on the server | LOW 2.0 | 0.3 % | ||
| CVE-2026-49268 | ≤ 2.2.0 ; 3.0.0-alpha-0 – 3.0.0-alpha-1 | Apache Shiro: LDAP DN Injection in DefaultLdapRealm | HIGH 8.8 | 0.5 % | ||
| CVE-2026-48589 | 2.0.0-alpha-0 – 2.2.0 ; 3.0.0-alpha-0 – 3.0.0-alpha-1 | Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow | NONE 0.0 | 0.4 % | ||
| CVE-2026-43828 | 1.0 – 2.1.0 ; 3.0.0-alpha-0 – 3.0.0-alpha-1 | Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-43827 | 1.0 – 2.1.0 ; 3.0.0-alpha-0 – 3.0.0-alpha-1 | Apache Shiro: Session fixation: new session is not created after login by default | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-23901 | < 2.0.7 | Apache Shiro: Brute force attack possible to determine valid user names | LOW 1.0 | 0.2 % | ||
| CVE-2026-23903 | < 2.0.7 | Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems | MEDIUM 5.3 | 0.4 % | ||
| CVE-2023-46749 | < 1.13.0 ; 2.0.0-alpha-1 – < 2.0.0-alpha-4 | Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when … | MEDIUM 6.5 | 1.2 % | ||
| CVE-2023-46750 | < 1.13.0 ; 2.0.0-alpha-1 – < 2.0.0-alpha-4 | Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro. | MEDIUM 6.1 | 1.5 % | ||
| CVE-2023-34478 | < 1.12.0 ; < 2.0.0-alpha-3 | Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web fra… | CRITICAL 9.8 | 2.1 % | ||
| CVE-2023-22602 | | Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request | HIGH 7.5 | 1.6 % | ||
| CVE-2022-40664 | Apache Shiro – < 1.10.0 | Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher | CRITICAL 9.8 | 3.6 % | ||
| CVE-2022-32532 | Before 1.9.1 | Authentication Bypass Vulnerability | CRITICAL 9.8 | 26 % | ||
| CVE-2021-41303 | Apache Shiro – < 1.8.0 | Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass | CRITICAL 9.8 | 76 % | ||
| CVE-2020-11989 | Apache Shiro 1.5.2 - 1.5.3 | Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication | CRITICAL 9.8 | 24 % |