Loading vulnerability…
Authentication Bypass in Apache Shiro shiro-guice
CVE-2026-56091 is an authentication bypass vulnerability in Apache Shiro's shiro-guice module when used in a web servlet context. A specially crafted HTTP request may bypass authentication and permit unauthorized access to protected web resources. Affected releases include all Apache Shiro versions through 2.x and versions 3.0.0-alpha-0 through 3.0.0-alpha-1 under this deployment configuration. The vulnerability is similar to CVE-2020-1957 but affects shiro-guice rather than shiro-spring.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthenticated attackers may access web resources protected by Apache Shiro authentication, potentially exposing sensitive application data or functionality. The extent of access depends on the protected resources available in the affected application.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary mitigation or workaround is specified.
Patch, then assume compromise.
Upgrade Apache Shiro's shiro-guice module and related packages to version 3.0.0 or later. For affected VMware Tanzu GemFire deployments, upgrade to version 10.3.0, which includes a fix for this CVE.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.