Apache Shiro notes add critical LDAP password bypass

1 source · 8 articlesFirst reported Nov 14, 2026 · 01:39 UTCUpdated Nov 14, 2026 · 06:00 UTC (7h ago)1

What's new

November 14: oss-security added CVE-2026-129349, a CVSS 4.0 9.1 DefaultLdapRealm password bypass when authentication caching is enabled, in shiro-core before 3.0.1.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Eight November 13 Apache Shiro advisories now include a critical cached-login password bypass in DefaultLdapRealm before 3.0.1.

Lenny Primak posted eight Apache Shiro notes to oss-security on November 13. The newest, CVE-2026-129349, scores CVSS 4.0 9.1 and affects org.apache.shiro:shiro-core before 3.0.1: with authentication caching enabled, DefaultLdapRealm caches a successful login and later accepts any password for that user because the LDAP bind is skipped. Earlier notes cover an incomplete path-matching fix (CVE-2026-114737), principal-tag XSS (CVE-2026-129320, 2.1), saved-form replay (CVE-2026-88019, 6.0), inconsistently enforced authorization annotations (CVE-2026-74763, 6.3), and RememberMe session fixation (CVE-2026-74762, 5.9). Empty-credential matching (CVE-2026-129347) and stale PropertiesRealm permissions (CVE-2026-129348) are both CVSS 4.0 2.3, affect versions through 3.0.1, and are fixed in 3.0.2. Several descriptions are truncated; exploitation is not reported.

Key facts

CVE-2026-129349: shiro-core before 3.0.1, CVSS 4.0 9.1, caching enabled.
Bypass applies only after one successful login; LDAP bind is then skipped.
CVE-2026-129347 and CVE-2026-129348 affect versions through 3.0.1; fixed in 3.0.2.
RememberMe session fixation affects shiro-core and shiro-web before 3.0.1, CVSS 4.0 5.9.
CVE-2026-114737 has no severity, affected range, or fixed release in the note.
No exploitation is mentioned in the posted notes.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first

Nov 13, 2026Incomplete path-matching fix posted as CVE-2026-114737. · oss-security
Nov 13, 2026Principal-tag XSS and saved-form replay notes posted. · oss-security
Nov 13, 2026Authorization-annotation and RememberMe session-fixation notes posted. · oss-security
Nov 13, 2026Empty-credential and PropertiesRealm reload flaws posted. · oss-security
Nov 13, 2026DefaultLdapRealm cached-login bypass posted as CVE-2026-129349. · oss-security

What each outlet adds

beyond the shared facts

oss-securityCritical DefaultLdapRealm bypass and seven other November 13 Shiro notes.

CVEs: CVE-2026-129349 CVE-2026-74763 CVE-2026-114737 CVE-2026-74762 CVE-2026-88019 CVE-2026-129320 CVE-2026-129347 CVE-2026-129348

Vendors: Apache
Products: Apache Shiro ShiroFilterFactoryBean shiro-core shiro-web

Coverage

oldest first · one row per article · UTC

01:39 UTC · 11h ago oss-securityFirst report
ShiroFilterFactoryBean default can bypass auth for static files
A prior CVE-2026-23903 fix did not cover manually created ShiroFilterFactoryBean instances.
01:41 UTC · 11h ago oss-security
Apache Shiro principal tags before 3.0.2 allow XSS (CVE-2026-129320)
Apache rates the flaw CVSS 4.0 2.1; it needs low privileges and user interaction.
04:51 UTC · 8h ago oss-security
Shiro Jakarta EE form replay may expose form data (CVE-2026-88019)
Only shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2 is listed, at CVSS 4.0 6.0.
04:53 UTC · 8h ago oss-security
Apache Shiro before 3.0.2 may skip authorization annotations (CVE-2026-74763)
Four integration modules are affected, with a medium CVSS 4.0 score of 6.3.
05:06 UTC · 8h ago oss-security
Apache Shiro before 3.0.1 allows session fixation via RememberMe
shiro-core and shiro-web before 3.0.1 are affected; CVSS 4.0 is 5.9, rated medium.
05:56 UTC · 7h ago oss-security
Apache Shiro before 3.0.2 treats empty credentials as a password match
CVE-2026-129347 is CVSS 4.0 2.3 and applies only to accounts with an empty stored credential.
05:58 UTC · 7h ago oss-security
Apache Shiro before 3.0.2 keeps deleted users after PropertiesRealm reload
CVE-2026-129348 is rated CVSS 4.0 2.3 and applies only when PropertiesRealm loads properties from a file.
06:00 UTC · 7h ago oss-security
Apache Shiro before 3.0.1 accepts any password with auth caching (CVE-2026-129349)
After one successful login, DefaultLdapRealm skips the LDAP bind and accepts any later password when caching is on.

Vulnerabilities in this story

All

CVE	CVSS	EPSS	Published
CVE-2026-114737	—	—	—
CVE-2026-129320	—	—	—
CVE-2026-129347	—	—	—
CVE-2026-129348	—	—	—
CVE-2026-129349	—	—	—
CVE-2026-74762	—	—	—
CVE-2026-74763	—	—	—
CVE-2026-88019	—	—	—