Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.shiro:shiro-guice

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2MavenAmendedPublished

    Apache Shiro shiro-guice module vulnerable to authentication bypass

    CVE-2026-56091 · GHSA-qj64-jj84-w38j

    Affected
    • Maven org.apache.shiro:shiro-guice >= 2.0.0, < 3.0.0
    Fixed in
    3.0.0· Vendor fix available
    Issue
    When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957, except that it affects the `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context. Upgrade to version 3.0.0 or later, which fixes the issue.

    Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →