{"id":"CVE-2026-23903","title":"Authentication Bypass by Alternate Name vulnerability in Apache Shiro.\n\nThis issue affects Apache Shiro: before 2.0.7.\n\nUsers are recommended to upgrade to version 2.0.7, which fixes the issue.\n\nThe issue only effects static files","summary":"Authentication Bypass by Alternate Name vulnerability in Apache Shiro.\n\nThis issue affects Apache Shiro: before 2.0.7.\n\nUsers are recommended to upgrade to version 2.0.7, which fixes the issue.\n\nThe issue only effects static files. If st…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-289"],"vendor":"apache","product":"shiro","affected":["shiro < 2.0.7"],"patched":["shiro 2.0.7"],"published":"2026-02-09","updated":"2026-08-20","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23903","references":[{"url":"https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/02/08/1","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00355,"epssPercentile":0.29203,"ingestedAt":"2026-08-20T17:59:03.927Z","slug":"CVE-2026-23903","body":"## Overview\n\nAuthentication Bypass by Alternate Name vulnerability in Apache Shiro.\n\nThis issue affects Apache Shiro: before 2.0.7.\n\nUsers are recommended to upgrade to version 2.0.7, which fixes the issue.\n\nThe issue only effects static files. If static files are served from a case-insensitive filesystem,\nsuch as default macOS setup, static files may be accessed by varying the case of the filename in the request.\nIf only lower-case (common default) filters are present in Shiro, they may be bypassed this way.\n\nShiro 2.1.0 and later has a new parameters to remediate this issue\nshiro.ini: filterChainResolver.caseInsensitive = true\napplication.properties: shiro.caseInsensitive=true\n\nShiro 3.0.0 and later makes this the default in shiro.ini-based configurations.\nShiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.\n\n## Affected\n\n- `shiro < 2.0.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `shiro 2.0.7`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}