{"id":"CVE-2026-23903","published":"2026-02-09T09:26:21Z","modified":"2026-08-20T09:44:32Z","title":"Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems","vendor":"Apache","product":"Apache Shiro","tier":"tail","description":{"text":"Authentication Bypass by Alternate Name vulnerability in Apache Shiro.\n\nThis issue affects Apache Shiro: before 2.0.7.\n\nUsers are recommended to upgrade to version 2.0.7, which fixes the issue.\n\nThe issue only effects static files. If static files are served from a case-insensitive filesystem,\nsuch as default macOS setup, static files may be accessed by varying the case of the filename in the request.\nIf only lower-case (common default) filters are present in Shiro, they may be bypassed this way.\n\nShiro 2.1.0 and later has a new parameters to remediate this issue\nshiro.ini: filterChainResolver.caseInsensitive = true\napplication.properties: shiro.caseInsensitive=true\n\nShiro 3.0.0 and later makes this the default in shiro.ini-based configurations.\nShiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00402,"percentile":0.3436,"provenance":"source"},"cwes":[{"id":"CWE-289","name":"Authentication Bypass by Alternate Name"}],"references":[{"url":"https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/02/08/1","tags":[]}],"priority":{"score":10.6,"factors":[{"name":"EPSS percentile","points":6.87},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Shiro","versions":["< 2.0.7"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-spring","vulnerableRanges":["<2.1.0"],"patched":["2.1.0"],"from":["GHSA-c244-p6m5-vqj6"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-6903","exploited":false,"provenance":"source"}}