Apache Software Foundation Apache Shiro

• CVE-2026-58301 Medium 5.9 Apache Shiro: Server-side POST request may be steered to an alternate host 0.5%
• CVE-2026-56091 High 8.2 Apache Shiro: Authentication bypass in Guice-Web integration 0.7%
• CVE-2026-56130 Low 2.0 Apache Shiro: Remember-me cookie isn't checked for expiry on the server 0.3%
• CVE-2026-49268 High 8.8 Apache Shiro: LDAP DN Injection in DefaultLdapRealm 0.5%
• CVE-2026-48589 None 0.0 Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow 0.4%
• CVE-2026-43828 Medium 5.9 Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default 0.3%
• CVE-2026-43827 Medium 5.9 Apache Shiro: Session fixation: new session is not created after login by default 0.4%
• CVE-2026-23901 Low 1.0 Apache Shiro: Brute force attack possible to determine valid user names 0.2%
• CVE-2026-23903 Medium 5.3 Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems 0.4%
• CVE-2023-46749 Medium 6.5 Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting 1.2%
• CVE-2023-46750 Medium 4.7 Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro. 1.5%
• CVE-2023-34478 Critical 9.8 Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests. 2.1%
• CVE-2023-22602 Unrated Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request 1.6%
• CVE-2022-40664 Critical 9.8 Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher 3.6%
• CVE-2022-32532 Unrated Authentication Bypass Vulnerability 25.5%
• CVE-2021-41303 Unrated Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass 76.1%
• CVE-2020-11989 Unrated Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. 24.4%