CVE-2022-32532: Authentication Bypass Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 25.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-29 · updated 2026-06-17
Weakness: CWE-863

Description

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Affected products

Apache Software Foundation Apache Shiro: before 1.9.1 — fixed in 1.9.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Shiro 1.9.1. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh
https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh

Get alerted when CVE-2022-32532 or the next vulnerability affects your stack