Apache Shiro before 3.0.1 accepts any password with auth caching (CVE-2026-129349)
Original title: CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled
After one successful login, DefaultLdapRealm skips the LDAP bind and accepts any later password when caching is on.
Lenny Primak reported CVE-2026-129349 in Apache Shiro (org.apache.shiro:shiro-core) before 3.0.1, scored CVSS 4.0 9.1. When authentication caching is enabled on DefaultLdapRealm, a successful login is cached and later logins for that user succeed with any password because the LDAP bind is skipped. The posted description is truncated; exploitation is not mentioned.
Unconfirmed: The snippet is truncated and does not state exploitation status or explicitly name the fixed release.
- CVSS 4.0 score is 9.1, rated critical in the post.
- Affected component is org.apache.shiro:shiro-core before 3.0.1.
- The bypass applies only after one successful login with caching enabled.
- Posted to oss-security by Lenny Primak on November 13.
Impact: Later logins succeed with any password
| Product | Affected | Fixed in |
|---|---|---|
| Apache Shiro | before 3.0.1 | 3.0.1 |
- 1.Upgrade org.apache.shiro:shiro-core to 3.0.1 or later.
- CVEs
- CVE-2026-129349
- Vendors
- Apache
- Products
- Apache Shiro
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-129349 | — | — | — |
From the original article
Posted by Lenny Primak on Nov 13 Severity: CVSS 4. 0: 9. 1 (critical) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.