SH
Product
Shiro
On CISA KEVExploited in the wild
25
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 4Medium 8Low 1
Watch
Add Shiro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-4437 In wildKEV | 9.8 | Jun 7 | Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access… Affected: before 1.2.5 |
| CVE-2023-34478 | 9.8 | Jul 24 | Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web… Affected: before 1.12.0; 2.0.0; 2.0.0 |
| CVE-2022-40664 | 9.8 | Oct 12 | Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher Affected: before 1.10.0 |
| CVE-2022-32532 | 9.8 | Jun 29 | Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers Affected: before 1.9.1 |
| CVE-2021-41303 | 9.8 | Sep 17 | Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass Affected: before 1.8.0 |
| CVE-2020-17523 | 9.8 | Feb 3 | Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass Affected: before 1.7.1 |
| CVE-2020-17510 | 9.8 | Nov 5 | Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass Affected: before 1.7.0 |
| CVE-2020-11989 | 9.8 | Jun 22 | Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass Affected: before 1.5.3 |
| CVE-2020-1957 | 9.8 | Mar 25 | Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass Affected: before 1.5.2 |
| CVE-2026-49268 | 9.1 | Jun 17 | Apache Shiro: LDAP DN Injection in DefaultLdapRealm Affected: before 2.2.1; 3.0.0 |
| CVE-2023-22602 | 7.5 | Jan 14 | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass Affected: before 1.11.0 |
| CVE-2020-13933 | 7.5 | Aug 17 | Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass Affected: before 1.6.0 |
| CVE-2019-12422 | 7.5 | Nov 18 | Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack Affected: before 1.4.2 |
| CVE-2016-6802 | 7.5 | Sep 20 | Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path Affected: 1.3.1 |
| CVE-2026-58301 | 6.5 | Aug 31 | Apache Shiro: Server-side POST request may be steered to an alternate host Affected: 2.0.0 before 3.0.1 |
| CVE-2026-43828 | 6.5 | May 25 | Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default Affected: before 2.1.1; 3.0.0 |
| CVE-2026-43827 | 6.5 | May 25 | Apache Shiro: Session fixation: new session is not created after login by default Affected: before 2.1.1; 3.0.0 |
| CVE-2023-46749 | 6.5 | Jan 15 | Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting … Affected: before 1.13.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2023-46750 | 6.1 | Dec 14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro Affected: before 1.13.0; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2026-48589 | 5.4 | May 25 | Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow Affected: 2.0.0 before 2.2.1; 3.0.0 |
| CVE-2026-44598 | 5.4 | May 25 | Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials) Affected: 2.0.0 before 2.1.1; 3.0.0 |
| CVE-2026-23903 | 5.3 | Feb 9 | Authentication Bypass by Alternate Name vulnerability in Apache Shiro Affected: before 2.0.7 |
| CVE-2026-23901 | 2.5 | Feb 10 | Observable Timing Discrepancy vulnerability in Apache Shiro Affected: before 2.0.7 |
| CVE-2014-0074 | – | Oct 6 | Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2)… Affected: 1.0.0; 1.1.0; 1.2.0; 1.2.1; 1.2.2 |
| CVE-2010-3863 | – | Nov 5 | Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass… Affected: through 1.0.0 |
Showing 25