{"id":"CVE-2026-56091","aliases":["GHSA-qj64-jj84-w38j"],"title":"Apache Shiro shiro-guice module vulnerable to authentication bypass","summary":"Apache Shiro shiro-guice module vulnerable to authentication bypass","severity":"high","cwe":["CWE-289"],"vendor":"apache","product":"org.apache.shiro:shiro-guice","ecosystem":"maven","affected":["org.apache.shiro:shiro-guice >= 2.0.0, < 3.0.0"],"patched":["org.apache.shiro:shiro-guice 3.0.0"],"published":"2026-06-25","updated":"2026-11-03","sourceUpdated":"2026-11-03T21:24:24Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-qj64-jj84-w38j","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56091"},{"url":"https://lists.apache.org/thread/onmtxmy2qonbpx7xlw3o34x8sctv47r7"},{"url":"https://github.com/github/advisory-database/pull/10078"},{"url":"https://github.com/apache/shiro/commit/42aa34467ad30f085fc8e003042db0c397fe8d57"},{"url":"https://github.com/advisories/GHSA-qj64-jj84-w38j"}],"tags":["ghsa","maven"],"epss":0.00669,"epssPercentile":0.5208,"ingestedAt":"2026-11-03T21:55:50.536Z","slug":"CVE-2026-56091","body":"## Overview\n\nWhen using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.\nThis vulnerability is similar to  https://www.cve.org/CVERecord?id=CVE-2020-1957, except that it affects the `shiro-guice` module instead of the `shiro-spring` module.\n\nThis issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context.\n\nUpgrade to version 3.0.0 or later, which fixes the issue.\n\n## Affected packages\n\n- `org.apache.shiro:shiro-guice >= 2.0.0, < 3.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.apache.shiro:shiro-guice 3.0.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}