CVE-2026-23903
mediumpriority · track · 0EPSS 0.004 · 34 %ileDEEUUSEPSS · scored 2026-10-27
Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (53)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1194Oracle Communications: Mehrere SchwachstellenDeutsch2026-04-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2026-2437Oracle Communications: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-c244-p6m5-vqj6Apache Shiro has an Authentication Bypass2026-02-09ghsa · osvUS
### Impact **Authentication Bypass:** A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows). The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting `/SECRET.TXT` to bypass a rule for `/secret.txt`). This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive. ### Patches Users should upgrade to Apache Shiro **2.1.0** or later. **Important Configuration Note:** Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue: * **shiro.ini:** ```ini filterChainResolver.caseInsensitive = true ``` * **Spring Boot (application.properties):** ```properties shiro.caseInsensitive=true ``` *Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.* ### Workarounds * Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix). * Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity). ### Resources * [CVE-2026-23903](https://nvd.nist.gov/vuln/detail/CVE-2026-23903) * [Mailing List Announcement](https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k) * [OSS-Security List](http://www.openwall.com/lists/oss-security/2026/02/08/1)
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/02/08/1cnnvd
- https://access.redhat.com/security/cve/cve-2026-23903cnnvd
- https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8kcnnvd
- https://shiro.apache.org/Patchcnnvd
- https://www.oracle.com/security-alerts/cpuapr2026.htmlcnnvd
- https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8kenisa_euvd
- http://www.openwall.com/lists/oss-security/2026/02/08/1Mailing ListThird Party Advisorynvd
- https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8kMailing ListVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan