Apache Shiro `shiro-guice` Authentication Bypass Fixed in 3.0.0
Vulnerability Disclosure · 3 sources · Updated 5mo ago · First seen Jun 25, 2026
Apache disclosed CVE-2026-56091, an authentication bypass vulnerability in the Apache Shiro shiro-guice module when deployed in a web servlet context. The flaw allows a specially crafted HTTP request to bypass authentication checks, creating a risk that unauthenticated users could reach protected application functionality. Apache described the issue as similar to CVE-2020-1957, but affecting shiro-guice rather than shiro-spring.
The vulnerability affects all Apache Shiro 2.x releases and 3.0.0-alpha-0 through 3.0.0-alpha-1 for the org.apache.shiro:shiro-guice component under the specified deployment conditions. Apache said the issue is remediated in Apache Shiro 3.0.0 and later and advised users to upgrade. The vulnerability was credited to LocalHost for discovery, with Lenny Primak credited for developing the fix.
