What’s Vulnerable › Products

Apache Software Foundation Apache Shiro vulnerabilities

27 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your Apache Software Foundation Apache Shiro version is affected

Exploited Apache Software Foundation Apache Shiro vulnerabilities

• CVE-2016-4437 — Apache Shiro Code Execution Vulnerability

Latest Apache Software Foundation Apache Shiro vulnerabilities

• CVE-2026-58301 — Apache Shiro: Server-side POST request may be steered to an alternate host (CVSS 6.5)
• CVE-2026-56130 — Apache Shiro: Remember-me cookie isn't checked for expiry on the server (CVSS 2.0)
• CVE-2026-56091 — Apache Shiro: Authentication bypass in Guice-Web integration (CVSS 8.2)
• CVE-2026-49268 — Apache Shiro: LDAP DN Injection in DefaultLdapRealm (CVSS 9.1)
• CVE-2026-48589 — Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow (CVSS 5.4)
• CVE-2026-44598 — Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials) (CVSS 5.4)
• CVE-2026-43828 — Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default (CVSS 6.5)
• CVE-2026-43827 — Apache Shiro: Session fixation: new session is not created after login by default (CVSS 6.5)
• CVE-2026-23901 — Apache Shiro: Brute force attack possible to determine valid user names (CVSS 2.5)
• CVE-2026-23903 — Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems (CVSS 5.3)
• CVE-2023-46749 — Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting (CVSS 6.5)
• CVE-2023-46750 — Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro. (CVSS 6.1)
• CVE-2023-34478 — Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests. (CVSS 9.8)
• CVE-2023-22602 — Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request (CVSS 7.5)
• CVE-2022-40664 — Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher (CVSS 9.8)
• CVE-2022-32532 — Authentication Bypass Vulnerability (CVSS 9.8)
• CVE-2021-41303 — Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass (CVSS 9.8)
• CVE-2020-17523 — (CVSS 9.8)
• CVE-2020-17510 — (CVSS 9.8)
• CVE-2020-13933 — (CVSS 7.5)
• CVE-2020-11989 — (CVSS 9.8)
• CVE-2020-1957 — (CVSS 9.8)
• CVE-2019-12422 — (CVSS 7.5)
• CVE-2016-6802 — (CVSS 7.5)
• CVE-2016-4437 — Apache Shiro Code Execution Vulnerability (CVSS 9.8) — exploited