Apache Shiro before 3.0.2 treats empty credentials as a password match
CVE-2026-129347 is CVSS 4.0 2.3 and applies only to accounts with an empty stored credential.
30
CVE-2026-129347 is CVSS 4.0 2.3 and applies only to accounts with an empty stored credential.
Today 1.1K readers · 1.3K views · 248 reads · all time 195K views