5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23903

CVE-2026-23903: Apache Shiro has an Authentication Bypass

Impact

Authentication Bypass: A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).

The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting /SECRET.TXT to bypass a rule for /secret.txt).

This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.

Patches

Users should upgrade to Apache Shiro 2.1.0 or later.

Important Configuration Note: Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:

shiro.ini:

filterChainResolver.caseInsensitive = true

Spring Boot (application.properties):
```
shiro.caseInsensitive=true
```

Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.

Workarounds

Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix).
Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).

Resources

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23903

CVE-2026-23903:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.shiro:shiro-spring	maven	<= 2.0.6	2.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass that occurs when Apache Shiro is used on a case-insensitive filesystem, such as default installations of Windows or macOS. The root cause lies in the org.apache.shiro.util.AntPathMatcher.matchStrings method, which performed case-sensitive path matching by default. When a security filter was configured for a lower-case path (e.g., /secret.txt), an attacker could request the same file with a different capitalization (e.g., /SECRET.TXT). The case-insensitive filesystem would serve the resource, but Shiro's case-sensitive matcher would fail to match the security rule, thus bypassing the intended access control.

The patch addresses this by introducing a caseInsensitive boolean property. The core change is within the AntPathMatcher.matchStrings method, which now uses a checkCase helper function to convert characters to lowercase before comparison if the caseInsensitive flag is enabled. This ensures that path matching can be configured to behave consistently with the underlying filesystem.

The analysis identified org.apache.shiro.util.AntPathMatcher.matchStrings as the primary vulnerable function because it contains the flawed comparison logic. The public-facing org.apache.shiro.util.AntPathMatcher.matches is also included as it is the direct entry point to the vulnerable code. Finally, org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.getChain is identified as a key function in the exploit path, as it is responsible for using the vulnerable path matcher to apply security filters to web requests.

Vulnerable functions

org.apache.shiro.util.AntPathMatcher.matchStrings

core/src/main/java/org/apache/shiro/util/AntPathMatcher.java

This private method contains the core logic for matching a string against a pattern. The vulnerability lies in its original implementation, which performed a strict case-sensitive character comparison. This allowed attackers to bypass URL-based security filters on case-insensitive file systems by altering the case of the requested path (e.g., `/secret.txt` vs `/SECRET.TXT`). The patch replaces the direct character comparison with a call to the new `checkCase` method, which can perform a case-insensitive comparison.

org.apache.shiro.util.AntPathMatcher.matches

core/src/main/java/org/apache/shiro/util/PatternMatcher.java

This public method is the entry point for the pattern matching logic and is part of the `PatternMatcher` interface. It delegates to the vulnerable `matchStrings` method (via the `match` and `doMatch` methods). During an exploit, this function would be present in the stack trace as it orchestrates the pattern matching process that leads to the authentication bypass.

org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.getChain

web/src/main/java/org/apache/shiro/web/filter/mgt/PathMatchingFilterChainResolver.java

This function resolves which filter chain to apply to an incoming web request by matching the request URI against configured path patterns. It uses an instance of `PatternMatcher` (typically `AntPathMatcher`) to perform this matching. It is the higher-level component that consumes the output of the vulnerable matching logic, making it a critical part of the exploit chain for bypassing authentication.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-23903: Apache Shiro has an Authentication Bypass

Impact

Patches

Workarounds

Resources

CVE-2026-23903:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

CVE-2026-23903: Apache Shiro has an Authentication Bypass

Impact

Patches

Workarounds

Resources

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

5.3

5.3

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI