CVE-2026-129349
Received Received - Intake

Authentication Bypass in Apache Shiro via LDAP Caching

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: Apache Software Foundation

Description
When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password. A cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher installed by default in DefaultLdapRealm accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user. This issue affects all Apache Shiro versions through 3.0.0, only when using DefaultLdapRealm (or JndiLdapRealm) with authenticationCachingEnabled set to true, which is not the default. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing AllowAllCredentialsMatcher by default. Alternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies credentials against the cached authentication info.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129349
EUVD
EUVD-2026-126005

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Shiro From 0 (inc) to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Apache Shiro versions before 3.0.1 when using DefaultLdapRealm with authentication caching enabled. After a user logs in successfully once, the system caches the authentication. Subsequent login attempts for that user bypass LDAP verification and accept any password because the default AllowAllCredentialsMatcher validates any credentials. An attacker who knows a valid username can exploit this to gain unauthorized access.

Detection Guidance

Check if Apache Shiro versions before 3.0.1 are in use, particularly with DefaultLdapRealm or JndiLdapRealm and authenticationCachingEnabled set to true. Inspect configuration files for these settings.

Impact Analysis

An attacker could impersonate legitimate users by authenticating with any password after knowing a valid username. This could lead to unauthorized access to sensitive data, system control, or privilege escalation. The impact depends on the privileges of the compromised accounts.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection) or HIPAA (health information security) by allowing unauthorized access to personal or sensitive data. Organizations may face legal penalties, reputational damage, or audit failures if exploited.

Mitigation Strategies

Upgrade to Apache Shiro version 3.0.1 or later. Alternatively, disable authentication caching on the LDAP realm or configure a credentials matcher like SimpleCredentialsMatcher.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129349. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...