Apache Shiro before 3.0.2 treats empty credentials as a password match
Original title: CVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password
CVE-2026-129347 is CVSS 4.0 2.3 and applies only to accounts with an empty stored credential.
Lenny Primak reported that Apache Shiro DefaultPasswordService and SimpleCredentialsMatcher can treat an empty stored credential as a match for an empty submitted password. All versions through 3.0.1 are affected when accounts have an empty stored credential; 3.0.2 is the fixed release. CVSS 4.0 is 2.3 (low). The description is truncated.
Unconfirmed: The snippet is cut off before the full account condition is stated.
- CVSS 4.0 score is 2.3 (low).
- Affected components are DefaultPasswordService and SimpleCredentialsMatcher.
- Versions through 3.0.1 are affected; 3.0.2 is fixed.
- The issue is limited to accounts with an empty stored credential.
Impact: Empty stored credential matches an empty submitted password
| Product | Affected | Fixed in |
|---|---|---|
| Apache Shiro (shiro-core) | through 3.0.1 (before 3.0.2) | 3.0.2 |
- 1.Upgrade org.apache.shiro:shiro-core to 3.0.2.
- CVEs
- CVE-2026-129347
- Vendors
- Apache
- Products
- Apache Shiro
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-129347 | — | — | — |
From the original article
Posted by Lenny Primak on Nov 13 Severity: CVSS 4. 0: 2. 3 (low) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.