CVE-2026-23901 Details
Description
Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.
A timing discrepancy vulnerability has been identified in Apache Shiro versions 1.* and 2.* prior to 2.0.7. This vulnerability allows a brute-force attack to determine valid usernames by timing requests to see if they failed due to a non-existent user or an incorrect password. The issue arises because the response times for these two scenarios are different enough to be noticeable. The vulnerability is likely exploitable only in a local context.
Users are advised to upgrade to Apache Shiro version 2.0.7 or later, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/02/08/2 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/mm1jct9b86jvnh3y44tj22xvjtx3xhhh | [email protected] | Issue TrackingMailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache shiro | < 2.0.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 12, 2026 | Initial Analysis | [email protected] |
| Feb 10, 2026 | CVE Modified | CVE |
| Feb 10, 2026 | New CVE Received | [email protected] |