CVE-2026-23903 Details
Description
Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.
An authentication bypass vulnerability has been identified in Apache Shiro versions prior to 2.0.7. This issue arises when static files are served from a case-insensitive filesystem, such as the default macOS setup. In such cases, access to static files can be manipulated by varying the case of the filename in the request. If only lowercase filters are applied in Shiro, they may be easily bypassed. Shiro versions 2.0.7 and later include a parameter to address this issue, which can be set in the shiro.ini or application.properties files. Additionally, Shiro 3.0.0 and later will default to this case-insensitive setting.
Users are advised to upgrade to Apache Shiro version 2.0.7 or later. For Shiro 2.0.7 and later, the case-insensitive parameter can be set to true in the shiro.ini or application.properties files. Shiro 3.0.0 and later will automatically apply this setting by default.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/02/08/1 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-289 | Authentication Bypass by Alternate Name | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache shiro | < 2.0.7 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 20, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 11, 2026 | Initial Analysis | [email protected] |
| Feb 9, 2026 | CVE Modified | CISA-ADP |
| Feb 9, 2026 | CVE Modified | CVE |
| Feb 9, 2026 | New CVE Received | [email protected] |