CVE-2026-56091High▾ TwilightApache Shiro shiro-guice module vulnerable to authentication bypass
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.7%
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957, except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
org.apache.shiro:shiro-guice >= 2.0.0, < 3.0.0Upgrade to a patched release:
org.apache.shiro:shiro-guice 3.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23903Medium· 5.3Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files
CVE-2026-50627Critical· 9.1The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens
CVE-2026-100351High· 7.4kin-openapi is a Go project for handling OpenAPI files
CVE-2025-13613Critical· 9.8The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2
CVE-2026-104143High· 8.7DataEase is an open source data visualization and analysis tool
CVE-2025-14777Medium· 6.0A flaw was found in Keycloak