Apache Shiro before 3.0.1 accepts any password with auth caching (CVE-2026-129349)
After one successful login, DefaultLdapRealm skips the LDAP bind and accepts any later password when caching is on.
62
Product
Apache Shiro
- Mentions · 7d8
- Mentions · 30d8
- All mentions8
- First seenNov 14, 2026
- Last mentioned7h ago
Timeline
8 articles · newest firstApache Shiro before 3.0.2 keeps deleted users after PropertiesRealm reload
CVE-2026-129348 is rated CVSS 4.0 2.3 and applies only when PropertiesRealm loads properties from a file.
28
Apache Shiro before 3.0.2 treats empty credentials as a password match
CVE-2026-129347 is CVSS 4.0 2.3 and applies only to accounts with an empty stored credential.
30
Apache Shiro before 3.0.1 allows session fixation via RememberMe
shiro-core and shiro-web before 3.0.1 are affected; CVSS 4.0 is 5.9, rated medium.
42
Apache Shiro before 3.0.2 may skip authorization annotations (CVE-2026-74763)
Four integration modules are affected, with a medium CVSS 4.0 score of 6.3.
46
Shiro Jakarta EE form replay may expose form data (CVE-2026-88019)
Only shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2 is listed, at CVSS 4.0 6.0.
42
Apache Shiro principal tags before 3.0.2 allow XSS (CVE-2026-129320)
Apache rates the flaw CVSS 4.0 2.1; it needs low privileges and user interaction.
36
ShiroFilterFactoryBean default can bypass auth for static files
A prior CVE-2026-23903 fix did not cover manually created ShiroFilterFactoryBean instances.
44
Related CVEs
by mentionsAppears with
- Apachevendor · 8
- shiro-coreproduct · 1
- ShiroFilterFactoryBeanproduct · 1
- shiro-webproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.