Apache Shiro LDAP Caching Flaw Allows Login With Any Password
Vulnerability Disclosure · 4 sources · Updated 42m ago · First seen Nov 15, 2026
A critical authentication-bypass vulnerability in Apache Shiro, CVE-2026-129349, allows attackers to authenticate as a valid user with any password when affected LDAP authentication caching is enabled. The flaw affects versions before 3.0.1 and has a reported CVSS 4.0 score of 9.1. In applications using DefaultLdapRealm or JndiLdapRealm, a successful login populates cached authentication information that can subsequently permit password-independent authentication for that user.
Exploitation requires knowledge of a valid username and the affected caching configuration, which is not enabled by default. Organizations using Shiro, a Java security framework, should check their LDAP realm configurations and upgrade to 3.0.1. Alternatives include disabling LDAP authentication caching or configuring a credentials matcher that verifies supplied credentials against the cached authentication information.
