Apache Shiro vulnerabilities

25 CVEs affecting Apache Shiro, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-58301, published 2026-08-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-4437: Apache Shiro Code Execution Vulnerability, published 2016-06-07. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 93% chance of exploitation in the next 30 days. Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an…
CVE-2020-17523, published 2021-02-03. Critical severity, CVSS 9.8. EPSS: 85.9% chance of exploitation in the next 30 days. Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
CVE-2021-41303, published 2021-09-17. Critical severity, CVSS 9.8. EPSS: 76.1% chance of exploitation in the next 30 days. Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
CVE-2010-3863, published 2010-11-05. Medium severity, CVSS 5.0. EPSS: 54.5% chance of exploitation in the next 30 days. Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access…
CVE-2020-13933, published 2020-08-17. High severity, CVSS 7.5. EPSS: 44.4% chance of exploitation in the next 30 days. Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.
CVE-2022-32532, published 2022-06-29. Critical severity, CVSS 9.8. EPSS: 25.5% chance of exploitation in the next 30 days. Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly…
CVE-2020-11989, published 2020-06-22. Critical severity, CVSS 9.8. EPSS: 24.4% chance of exploitation in the next 30 days. Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVE-2020-1957, published 2020-03-25. Critical severity, CVSS 9.8. EPSS: 23.3% chance of exploitation in the next 30 days. Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVE-2016-6802, published 2016-09-20. High severity, CVSS 7.5. EPSS: 9.7% chance of exploitation in the next 30 days. Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
CVE-2019-12422, published 2019-11-18. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

Latest

CVE-2026-58301, published 2026-08-31. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and…
CVE-2026-49268, published 2026-06-17. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN…
CVE-2026-48589, published 2026-05-25. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value…
CVE-2026-44598, published 2026-05-25. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha…
CVE-2026-43828, published 2026-05-25. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are…
CVE-2026-43827, published 2026-05-25. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version…
CVE-2026-23901, published 2026-02-10. Low severity, CVSS 2.5. EPSS: 0.2% chance of exploitation in the next 30 days. Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the…
CVE-2026-23903, published 2026-02-09. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The…
CVE-2023-46749, published 2024-01-15. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to…
CVE-2023-46750, published 2023-12-14. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.