Vulnerability · Published Feb 10, 2026 · Assigned by apache
CVE-2026-23901Apache Shiro: Brute force attack possible to determine valid user names
Low 1.0
In plain English
A low-severity security flaw in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | shiro | no fix listed | DEBIAN-CVE-2026-23901 |
| Debian:13 | shiro | no fix listed | DEBIAN-CVE-2026-23901 |
| Debian:14 | shiro | no fix listed | DEBIAN-CVE-2026-23901 |
| Maven | org.apache.shiro:shiro-core | 2.1.0 | GHSA-c4qc-4q9p-m9q9 |
| Ubuntu:22.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-23901 |
| Ubuntu:25.10 | shiro | no fix listed | UBUNTU-CVE-2026-23901 |
| Ubuntu:26.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-23901 |
| Ubuntu:26.10 | shiro | no fix listed | UBUNTU-CVE-2026-23901 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Shiro | 0 – before 2.0.7 |
Weakness: CWE-208 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/R:A/V:C/RE:L/U:Green