Skip to main content

Apache Shiro CVE-2026-56091

| EUVDEUVD-2026-39230 HIGH
Authentication Bypass by Alternate Name (CWE-289)
2026-06-24 GHSA-qj64-jj84-w38j
Authentication Bypass Java Apache
8.2
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:D/RE:L/U:Amber
vuln.today AI
5.9 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but the crafted-path requirement makes it AC:H; impact is confidentiality-only (C:H, I:N, A:N) consistent with the vendor's 4.0 scoring.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:D/RE:L/U:Amber
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
P

Lifecycle Timeline

5
Analysis Updated
Jun 25, 2026 - 09:32 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 25, 2026 - 09:32 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 25, 2026 - 09:23 vuln.today
cvss_changed
CVSS changed
Jun 25, 2026 - 09:23 NVD
8.2 (HIGH)
Analysis Generated
Jun 24, 2026 - 20:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 2

News 3 New Java Vulnerabilities - 2 Critical, 1 High Severity Jun 25, 2026 News Critical Authentication Bypass in Apache Shiro shiro-guice - CVE-2026-56091 Jun 24, 2026

AnalysisAI

Authentication bypass in Apache Shiro affects deployments using the shiro-guice module in a web servlet context, where a specially crafted HTTP request can evade path-based access controls and reach protected resources without valid credentials. It mirrors the older shiro-spring flaw CVE-2020-1957 but targets the Guice integration instead, impacting all Shiro releases through 2.x and 3.0.0-alpha-1. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify web app using shiro-guice
Delivery
Map protected filter-chain URL patterns
Exploit
Craft request with alternate path representation
Execution
Bypass Shiro authentication filter
Impact
Access protected resource and read data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the target application to use the shiro-guice module deployed in a web servlet context - this is the exact prerequisite stated in the description and is not Shiro's default for most users (many use shiro-spring or non-web setups). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are moderate-to-high but not maximal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker enumerates a web application that uses Apache Shiro's Guice integration and identifies an administrative or otherwise protected URL guarded by a Shiro filter. By sending a specially crafted HTTP request whose path is normalized differently by the servlet container than by Shiro's matcher, the attacker reaches the protected endpoint without authenticating and reads sensitive data behind it. …
Remediation Vendor-released patch: upgrade to Apache Shiro 3.0.0 or later, which corrects the path-matching behavior in the shiro-guice module; this is the primary and recommended fix per the vendor advisory at https://shiro.apache.org/ and the announcement at https://lists.apache.org/thread/onmtxmy2qonbpx7xlw3o34x8sctv47r7. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Audit asset inventory to identify all systems running Apache Shiro with shiro-guice module and document exact versions in use. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-289 – Authentication Bypass by Alternate Name

View all
CVE-2021-34746 CRITICAL POC
9.8
CVE-2023-38487 HIGH POC
8.2
CVE-2023-1803 CRITICAL
9.8
CVE-2026-9701 CRITICAL
9.8
CVE-2026-24058 CRITICAL
9.8
CVE-2025-29266 CRITICAL
9.6
CVE-2026-50627 CRITICAL
9.1
CVE-2025-55130 CRITICAL
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-56091 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy