---
id: CVE-2026-56091
aliases:
  - GHSA-qj64-jj84-w38j
title: Apache Shiro shiro-guice module vulnerable to authentication bypass
summary: Apache Shiro shiro-guice module vulnerable to authentication bypass
severity: high
cwe:
  - CWE-289
vendor: apache
product: 'org.apache.shiro:shiro-guice'
ecosystem: maven
affected:
  - 'org.apache.shiro:shiro-guice >= 2.0.0, < 3.0.0'
patched:
  - 'org.apache.shiro:shiro-guice 3.0.0'
published: '2026-06-25'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T21:24:24Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-qj64-jj84-w38j'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56091'
  - url: 'https://lists.apache.org/thread/onmtxmy2qonbpx7xlw3o34x8sctv47r7'
  - url: 'https://github.com/github/advisory-database/pull/10078'
  - url: >-
      https://github.com/apache/shiro/commit/42aa34467ad30f085fc8e003042db0c397fe8d57
  - url: 'https://github.com/advisories/GHSA-qj64-jj84-w38j'
tags:
  - ghsa
  - maven
epss: 0.00669
epssPercentile: 0.5208
ingestedAt: '2026-11-03T21:55:50.536Z'
---

## Overview

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to  https://www.cve.org/CVERecord?id=CVE-2020-1957, except that it affects the `shiro-guice` module instead of the `shiro-spring` module.

This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context.

Upgrade to version 3.0.0 or later, which fixes the issue.

## Affected packages

- `org.apache.shiro:shiro-guice >= 2.0.0, < 3.0.0`

## Remediation

Upgrade to a patched release:

- `org.apache.shiro:shiro-guice 3.0.0`