Apache Shiro DefaultLdapRealm Flaw Enables LDAP Injection and Authentication Bypass
Vulnerability Disclosure · 3 sources · Updated 5mo ago · First seen Jun 17, 2026
Apache disclosed CVE-2026-49268, a high-severity LDAP Distinguished Name injection flaw in Apache Shiro’s DefaultLdapRealm that can let remote attackers manipulate LDAP bind authentication. The vulnerability is caused by directly concatenating user-supplied usernames into an LDAP DN template without escaping RFC 2253 special characters, allowing an attacker to alter DN construction and potentially bypass authentication or impersonate legitimate users. The issue carries a CVSS v4 score of 8.8 and is considered remotely exploitable.
The flaw affects Apache Shiro shiro-core through 2.2.0 and 3.0.0-alpha-0 through 3.0.0-alpha-1 when DefaultLdapRealm is in use. Apache said organizations should identify deployments using that realm and upgrade to 2.2.1 or 3.0.0-alpha-2 or later; input escaping for usernames is also recommended. The advisory credited zhaokaifei of ChinaTelecom with reporting the issue and Lenny Primak with developing the fix.
