Loading vulnerability…
Apache Shiro LDAP Authentication Cache Bypass
CVE-2026-129349 is an authentication-bypass vulnerability affecting Apache Shiro versions through 3.0.0 when DefaultLdapRealm or JndiLdapRealm is configured with authenticationCachingEnabled set to true. After a successful login populates a user's authentication cache entry, subsequent authentication skips the LDAP bind. The AllowAllCredentialsMatcher installed by default accepts arbitrary credentials, allowing an attacker who knows the cached user's username to authenticate with any password. LDAP authentication caching is disabled by default.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can impersonate a user whose authentication information is cached, gaining access to application data and operations permitted to that account. This can result in substantial confidentiality and integrity compromise, depending on the impersonated user's authorization. No direct availability impact is identified in the vulnerability's CVSS 4.0 assessment.
If you can’t patch tonight, do this now.
Disable authentication caching on DefaultLdapRealm or JndiLdapRealm by setting authenticationCachingEnabled to false, which is the default. Alternatively, configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies supplied credentials against cached authentication information.
Patch, then assume compromise.
Upgrade Apache Shiro to version 3.0.1 or later. Version 3.0.1 fixes the issue by no longer installing AllowAllCredentialsMatcher by default.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.