Which versions of Apache Shiro are affected by CVE-2026-56091?

Apache Shiro's shiro-guice module contains an authentication bypass vulnerability (CVE-2026-56091) with no public exploit identified at time of analysis, but allows unauthenticated attackers to…

How to fix or mitigate CVE-2026-56091?

24 hours: Audit asset inventory to identify all systems running Apache Shiro with shiro-guice module and document exact versions in use. 7 days: Deploy Web Application Firewall (WAF) rules to detect path-manipulation patterns; implement network segmentation to restrict direct access to affected Shiro applications; enable additional authentication enforcement at reverse proxy or API gateway layer. 30 days: Apply vendor patch immediately upon release (monitor Apache Shiro release notes); if unavailable, migrate sensitive applications to alternative authentication frameworks or disable Guice integration if operationally possible.

Apache Shiro CVE-2026-56091

Q: What is the CVSS score of CVE-2026-56091?

CVE-2026-56091 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:D/RE:L/U:Amber. EPSS exploitation probability: 0.4%.

EUVD-2026-39230 HIGH

Authentication Bypass by Alternate Name (CWE-289)

2026-06-24

GHSA-qj64-jj84-w38j

Authentication Bypass Apache Java

8.2

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:D/RE:L/U:Amber

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but the crafted-path requirement makes it AC:H; impact is confidentiality-only (C:H, I:N, A:N) consistent with the vendor's 4.0 scoring.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 25, 2026 - 09:32 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 25, 2026 - 09:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 25, 2026 - 09:23 vuln.today

cvss_changed

CVSS changed

Jun 25, 2026 - 09:23 NVD

8.2 (HIGH)

Analysis Generated

Jun 24, 2026 - 20:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 2

News 3 New Java Vulnerabilities - 2 Critical, 1 High Severity Jun 25, 2026 News Critical Authentication Bypass in Apache Shiro shiro-guice - CVE-2026-56091 Jun 24, 2026

AnalysisAI

Authentication bypass in Apache Shiro affects deployments using the shiro-guice module in a web servlet context, where a specially crafted HTTP request can evade path-based access controls and reach protected resources without valid credentials. It mirrors the older shiro-spring flaw CVE-2020-1957 but targets the Guice integration instead, impacting all Shiro releases through 2.x and 3.0.0-alpha-1. No public exploit identified at time of analysis, though the CVSS 4.0 base score of 8.2 reflects high confidentiality impact and the close analogy to a previously exploited bug class.

Technical ContextAI

Apache Shiro is a widely used Java security framework providing authentication, authorization, session management, and cryptography; the shiro-guice module integrates Shiro's filter chain into applications wired with Google Guice rather than Spring. The root cause is classified as CWE-289 (Authentication Bypass by Alternate Name), meaning the URL/path matching that maps incoming requests to Shiro's security filters can be tricked by alternate request representations (e.g., crafted path encodings or trailing-segment tricks) so a request that should match a protected filter pattern is instead treated as unprotected. This is the same normalization/path-matching discrepancy between the servlet container and Shiro's pattern matcher that produced CVE-2020-1957 in the shiro-spring module, now reproduced in the Guice servlet context.

RemediationAI

Vendor-released patch: upgrade to Apache Shiro 3.0.0 or later, which corrects the path-matching behavior in the shiro-guice module; this is the primary and recommended fix per the vendor advisory at https://shiro.apache.org/ and the announcement at https://lists.apache.org/thread/onmtxmy2qonbpx7xlw3o34x8sctv47r7. If immediate upgrade is not possible, apply compensating controls: define Shiro filter-chain path patterns defensively (prefer explicit, restrictive patterns and avoid relying solely on wildcard prefixes), and enforce authentication at an additional layer such as a reverse proxy or servlet container security constraint so that a Shiro matcher bypass does not by itself grant access - note this duplicates access logic and must be kept in sync. Normalizing and rejecting ambiguous request paths (e.g., requests containing encoded path separators, redundant separators, or trailing constructs) at a WAF or proxy can block the crafted-request technique, but tune carefully to avoid breaking legitimate URLs. Treat these as stopgaps; only the 3.0.0 upgrade fully resolves the matcher discrepancy.