CVE-2026-23903— Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-23903
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
Source: NVD (National Vulnerability Database)
Vulnerability Description
Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.0.7 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.propertie: shiro.caseInsensitive=true Shiro 3.0.0 and later (upcoming) makes this the default.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用候选名称进行的认证绕过
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Shiro 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Shiro是美国阿帕奇（Apache）基金会的一套用于执行认证、授权、加密和会话管理的Java安全框架。 Apache Shiro 2.0.7之前版本存在安全漏洞，该漏洞源于备用名称身份验证绕过，可能导致在大小写不敏感的文件系统上绕过过滤器访问静态文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Shiro | 0 ~ 2.0.7 | - |
II. Public POCs for CVE-2026-23903
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23903
请登录查看更多情报信息。
Same Patch Batch · Apache Software Foundation · 2026-02-09 · 3 CVEs total
| CVE-2026-22922 | Apache Airflow: Airflow externalLogUrl Permission Bypass | |
| CVE-2026-24098 | Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors |
IV. Related Vulnerabilities
Same product: Apache Shiro
- CVE-2026-23901
Apache Shiro: Brute force attack possible to determine valid - CVE-2023-46749
Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be suscepti - CVE-2023-46750
Apache Shiro: URL Redirection to Untrusted Site ('Open Redir - CVE-2023-34478
Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be suscept - CVE-2023-22602
Apache Shiro before 1.11.0, when used with Spring Boot 2.6+,
Same vendor: Apache Software Foundation
- CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on Tin - CVE-2026-25199
Apache CloudStack: Proxmox Extension Allows Unauthorized Cro - CVE-2026-25077
Apache CloudStack: Unauthenticated Command Injection in Dire - CVE-2025-69233
Apache CloudStack: Domain/account resources limits not honor - CVE-2025-66467
Apache CloudStack: MinIO policy remains intact on bucket del
Same weakness: CWE-289
- CVE-2026-3184
Util-linux: util-linux: access control bypass due to imprope - CVE-2026-32036
OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot- - CVE-2026-24058
Soft Serve has Critical Authentication Bypass - CVE-2025-14777
Keycloak: keycloak idor in realm client creating/deleting - CVE-2025-13613
Elated Membership <= 1.2 - Authentication Bypass via Social
V. Comments for CVE-2026-23903
No comments yet