Threats affecting pkg:maven/org.apache.shiro/shiro-core

CVE-2026-49268 is a high-severity LDAP injection vulnerability in Apache Shiro's DefaultLdapRealm class. It allows remote attackers to inject LDAP special characters into the Distinguished Name (DN) construction by concatenating user-supplied usernames without proper escaping. This can lead to manipulation of the LDAP DN used for bind authentication, potentially enabling authentication bypass or user impersonation. The vulnerability affects all Apache Shiro versions through 2.2.0 and 3.0.0-alpha-1 when using DefaultLdapRealm. Upgrading to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later addresses the issue.

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

Apache Shiro versions 1.0, 3.0.0-alpha, and up to 2.1.0 have a session fixation vulnerability in their default configurations. The issue occurs because existing sessions are not invalidated nor replaced with new session IDs upon successful login. This vulnerability allows an attacker to fixate a user's session ID, potentially leading to unauthorized session use. The vulnerability is fixed in Apache Shiro versions 2.1.1 and 3.0.0-alpha-2 or later.

Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs.existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs.wrong password. The most likely attack vector is a local attack only. Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).