High severity · published Jun 25, 2026
CVE-2026-56091
Apache Shiro: Authentication bypass in Guice-Web integration
8.2
CVSS
0.7%
EPSS
No
On KEV
Description
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Apache Shiro · Apache Software Foundation
through 2.99.99; 3.0.0-alpha-0 through 3.0.0-alpha-1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56091
lists.apache.org
https://lists.apache.org/thread/onmtxmy2qonbpx7xlw3o34x8sctv47r7
More from Apache Shiro
9.8
CVE-2022-40664
Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
9.1
CVE-2026-49268
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
6.5
CVE-2026-58301
Apache Shiro: Server-side POST request may be steered to an alternate host
6.5
CVE-2026-43828
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
6.5
CVE-2026-43827
Apache Shiro: Session fixation: new session is not created after login by default