NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

#apache-shiro

8 stories this week · 8 this month · 8 in 6 months · mostly security

Stories per day · 30 days

Relatedjava5 shiro-core3 authentication2 jakarta-ee2 auth-bypass1 authentication-bypass1 authorization1 cookies1 credentials1 form-replay1 jakarta1 ldap1 path-matching1 properties-realm1 rememberme1 session-fixation1 shiro-web1 xss1

1 stories, newest first · one card per story

oss-security7h agohigh

Apache Shiro before 3.0.1 accepts any password with auth caching (CVE-2026-129349)

After one successful login, DefaultLdapRealm skips the LDAP bind and accepts any later password when caching is on.

8 sources apache-shiro ldap