CVE-2026-23903 — Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems

Description (CNA)

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Shiro	affected 0 before 2.0.7

CWE

CWE-289

References

https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/02/08/1

CISA-ADP

No English description supplied.

No references supplied.