CVE-2026-23901

< 2.0.7

Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1., 2. before 2.0.7. Users

2.5LOW

CVE-2026-23903

< 2.0.7

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are

5.3MEDIUM

CVE-2023-46749

< 1.13.0

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypas

6.5MEDIUM

CVE-2023-46750

< 1.13.0

URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation:

6.1MEDIUM

CVE-2023-34478

< 1.12.0

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypa

9.8CRITICAL

CVE-2023-22602

< 1.11.0

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication

7.5HIGH

CVE-2022-40664

< 1.10.0

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.

9.8CRITICAL

CVE-2022-32532

< 1.9.1

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications usin

9.8CRITICAL

CVE-2021-41303

< 1.8.0

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication

9.8CRITICAL

CVE-2020-17523

< 1.7.1

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypas

9.8CRITICAL

CVE-2020-17510

< 1.7.0

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypas

9.8CRITICAL

CVE-2020-13933

< 1.6.0

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

7.5HIGH

CVE-2020-11989

< 1.5.3

Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authe

9.8CRITICAL

CVE-2020-1957

< 1.5.2

Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authe

9.8CRITICAL

CVE-2019-12422

< 1.4.2

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

7.5HIGH

CVE-2016-6802

all versions

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root serv

7.5HIGH

CVE-2016-4437

< 1.2.5

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to exe

9.8CRITICAL

CVE-2014-0074

all versions

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass auth

CVE-2010-3863

<= 1.0.0

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini