Critical severity · published Jun 17, 2026
CVE-2026-49268
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.
This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm
Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Apache Shiro · Apache Software Foundation
through 2.2.0; 3.0.0-alpha-0 through 3.0.0-alpha-1 · source: vendor
SH
Shiro · Apache
before 2.2.1; 3.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49268
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49268
Mailing List
https://lists.apache.org/thread/svszql3od8td7hn6conyj2oq70v53b5s
Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/06/17/8
More from Apache Shiro
9.8
CVE-2022-40664
Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
8.2
CVE-2026-56091
Apache Shiro: Authentication bypass in Guice-Web integration
6.5
CVE-2026-58301
Apache Shiro: Server-side POST request may be steered to an alternate host
6.5
CVE-2026-43828
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
6.5
CVE-2026-43827
Apache Shiro: Session fixation: new session is not created after login by default