Executive Summary

CVE-2026-23901 is a low-severity vulnerability in Apache Shiro versions 1.* up to before 2.0.7 involving an observable timing discrepancy.

The vulnerability arises because the code paths for handling authentication failures differ in timing when the username does not exist versus when the password is incorrect for an existing user.

An attacker can exploit this timing difference by measuring how long authentication requests take to fail, thereby distinguishing valid usernames from non-existent ones.

This enables username enumeration through timing analysis, primarily in local attack scenarios.

The issue is fixed in Apache Shiro version 2.0.7 and later.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to perform username enumeration by distinguishing valid usernames from invalid ones based on timing differences during authentication failures.

With valid usernames identified, an attacker can focus brute-force password attacks more effectively.

However, the attack vector is primarily local, and brute-force attacks can often be mitigated at the infrastructure level.

Overall, the impact is considered low severity but could aid attackers in compromising user accounts if combined with other weaknesses.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by performing timing analysis on authentication requests to Apache Shiro. Specifically, by measuring the time taken for authentication failures, an attacker or tester can distinguish between non-existent usernames and existing usernames with incorrect passwords due to observable timing discrepancies.

Detection involves sending multiple authentication requests with different usernames and measuring the response times to identify statistically significant differences.

No specific commands are provided in the available resources, but typical approaches might include using tools like curl or custom scripts to automate authentication attempts and measure response times.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate step to mitigate this vulnerability is to upgrade Apache Shiro to version 2.0.7 or later, where the issue has been fixed.

Additionally, mitigation can be implemented at the infrastructure level to prevent brute-force attacks, such as rate limiting, account lockout policies, or other brute-force protections.

Useful 0 Not Useful 0