In short
- CVE-2026-23903 is a MEDIUM (CVSS 5.3) vulnerability affecting org.apache.shiro:shiro-spring, shiro (apache).
- Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.5% of all vulnerabilities.
- Fix: update to 2.1.0, 2.0.7 or later.
Description
Impact
Authentication Bypass:
A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).
The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting /SECRET.TXT to bypass a rule for /secret.txt).
This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.
Patches
Users should upgrade to Apache Shiro 2.1.0 or later.
Important Configuration Note:
Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:
Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.
Workarounds
- Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix).
- Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).
Resources
NVD description
Authentication Bypass by Alternate Name vulnerability in Apache Shiro.
This issue affects Apache Shiro: before 2.0.7.
Users are recommended to upgrade to version 2.0.7, which fixes the issue.
The issue only effects static files. If static files are served from a case-insensitive filesystem,
such as default macOS setup, static files may be accessed by varying the case of the filename in the request.
If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.
Shiro 2.1.0 and later has a new parameters to remediate this issue
shiro.ini: filterChainResolver.caseInsensitive = true
application.properties: shiro.caseInsensitive=true
Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations.
Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.
More vulnerabilities in org.apache.shiro:shiro-spring
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free