CVE-2026-23903
Gravedad CVSS v3.1:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
09/02/2026
Última modificación:
09/02/2026
Descripción
*** Pendiente de traducción *** Authentication Bypass by Alternate Name vulnerability in Apache Shiro.<br />
<br />
This issue affects Apache Shiro: before 2.0.7.<br />
<br />
Users are recommended to upgrade to version 2.0.7, which fixes the issue.<br />
<br />
The issue only effects static files. If static files are served from a case-insensitive filesystem,<br />
such as default macOS setup, static files may be accessed by varying the case of the filename in the request.<br />
If only lower-case (common default) filters are present in Shiro, they may be bypassed this way.<br />
<br />
Shiro 2.0.7 and later has a new parameters to remediate this issue<br />
shiro.ini: filterChainResolver.caseInsensitive = true<br />
application.propertie: shiro.caseInsensitive=true<br />
<br />
Shiro 3.0.0 and later (upcoming) makes this the default.
Impacto
Puntuación base 3.x
5.30
Gravedad 3.x
MEDIA