CVE-2026-23903
Authentication Bypass in Apache Shiro Static File Handling
Publication date: 2026-02-09
Last updated on: 2026-02-11
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | shiro | to 2.0.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-289 | The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Authentication Bypass by Alternate Name issue in Apache Shiro versions before 2.0.7.
It affects static files served from case-insensitive filesystems (like the default macOS setup), allowing access to static files by varying the case of the filename in the request.
If only lower-case filters are used in Shiro, this case variation can bypass those filters, leading to unauthorized access.
The issue is fixed in Apache Shiro version 2.0.7 by introducing parameters to handle case insensitivity in filter chains.
How can this vulnerability impact me? :
This vulnerability can allow unauthorized users to access static files that should be protected by authentication filters.
If your system serves static files from a case-insensitive filesystem and uses Apache Shiro versions before 2.0.7 without proper configuration, attackers may bypass security filters by altering the case of filenames.
This could lead to exposure of sensitive static content that was intended to be restricted.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Authentication Bypass by Alternate Name vulnerability in Apache Shiro, users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.
Additionally, you can configure Shiro to handle case insensitivity properly by setting the following parameters:
- In shiro.ini: filterChainResolver.caseInsensitive = true
- In application.properties: shiro.caseInsensitive=true
Note that Shiro 3.0.0 and later will make this case-insensitive handling the default behavior.