Authentication Bypass by Alternate Name vulnerability in Apache Shiro.
This issue affects Apache Shiro: before 2.0.7.
Users are recommended to upgrade to version 2.0.7, which fixes the issue.
The issue only effects static files. If static files are served from a case-insensitive filesystem,
such as default macOS setup, static files may be accessed by varying the case of the filename in the request.
If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.
Shiro 2.0.7 and later has a new parameters to remediate this issue
shiro.ini: filterChainResolver.caseInsensitive = true
application.propertie: shiro.caseInsensitive=true
Shiro 3.0.0 and later (upcoming) makes this the default.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/02/08/1 | Mailing List Third Party Advisory |
Configurations
History
11 Feb 2026, 18:30
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache shiro
Apache |
|
| References | () https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/02/08/1 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* |
09 Feb 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
09 Feb 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Feb 2026, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-09 10:15
Updated : 2026-02-11 18:30
NVD link : CVE-2026-23903
Mitre link : CVE-2026-23903
CVE.ORG link : CVE-2026-23903
JSON object : View
Products Affected
apache
- shiro
CWE
CWE-289
Authentication Bypass by Alternate Name