CVE-2026-23903

Katalog CVE

CVSS 5.3 · Medium EPSS 0,40%

Kerentanan Authentication Bypass by Alternate Name pada apache shiro. Skor CVSS 3.1 5.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Rincian

Terbit di NVD

9 Februari 2026

Terakhir diubah

20 Agustus 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-289: Authentication Bypass by Alternate Name

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/02/08/1 mailing list · advisory pihak ketiga