ShiroFilterFactoryBean default can bypass auth for static files
Original title: CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files
A prior CVE-2026-23903 fix did not cover manually created ShiroFilterFactoryBean instances.
An oss-security note says the earlier Apache Shiro fix for CVE-2026-23903 was incomplete for manually created ShiroFilterFactoryBean objects. Those still match paths case-sensitively by default, which can bypass authentication for static files. The available text, posted by Lenny Primak on November 13, does not give a severity score or a fixed release.
Unconfirmed: The snippet does not state severity, affected versions, or a fixed release.
- The new issue is tracked as CVE-2026-114737.
- Case-sensitive matching remains the default for manually created beans.
- No affected range or fixed version appears in the snippet.
Impact: authentication bypass for static files
| Product | Affected |
|---|---|
| Apache Shiro | — |
- CVEs
- CVE-2026-114737
- Vendors
- Apache
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114737 | — | — | — |
From the original article
Posted by Lenny Primak on Nov 13 Severity: https://shiro. apache. org/security-reports.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.