Apache Shiro shiro-guice module vulnerable to authentication bypass
GHSA-qj64-jj84-w38j · CVE-2026-56091
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957, except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56091
- WEB https://github.com/github/advisory-database/pull/10078
- WEB https://github.com/apache/shiro/commit/42aa34467ad30f085fc8e003042db0c397fe8d57
- PACKAGE https://github.com/apache/shiro
- WEB https://lists.apache.org/thread/onmtxmy2qonbpx7xlw3o34x8sctv47r7
Ready to move
Start Securing
Free, no credit card | First findings in minutes