CVE-2026-23903

Authentication Bypass by Alternate Name vulnerability in Apache Shiro.<br /> <br /> This issue affects Apache Shiro: before 2.0.7.<br /> <br /> Users are recommended to upgrade to version 2.0.7, which fixes the issue.<br /> <br /> The issue only effects static files. If static files are served from a case-insensitive filesystem,<br /> such as default macOS setup, static files may be accessed by varying the case of the filename in the request.<br /> If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.<br /> <br /> Shiro 2.0.7 and later has a new parameters to remediate this issue<br /> shiro.ini: filterChainResolver.caseInsensitive = true<br /> application.propertie: shiro.caseInsensitive=true<br /> <br /> Shiro 3.0.0 and later (upcoming) makes this the default.