Vulnerability · low · CVSS 2.3
Apache Shiro case-insensitive path matching auth bypass for static files (CVE-2026-114737)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Apps using shiro-spring 3.0.1 with static file path rules
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade org.apache.shiro:shiro-spring to 3.0.2 or later.
The Brief
- Apache Shiro has a case-insensitive path matching issue in the default configuration of ShiroFilterFactoryBean that allows authentication bypass for static files.
- The affected package is org.apache.shiro:shiro-spring from 3.0.1 before 3.0.2.
- The source rates the issue CVSS 4.0 2.3 (low) and describes it as related to the fix for CVE-2026-23903.
Why it matters
Applications using shiro-spring 3.0.1 that protect static files with Shiro path rules may serve those files without authentication.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Shiro is a Java security framework that developers build applications with. |
| No | Core infrastructure | Judgment: a single Java framework, not software nearly every team runs like OpenSSH or glibc. |
| Yes | Popular tool | Judgment: Shiro is a widely used Java framework across many enterprise teams. |
| No | Exploited in the wild | Open Source Security: the advisory reports the flaw and CVSS only; no observed attacks mentioned. |
| No | Public exploit | Open Source Security: the advisory gives no exploit code or proof-of-concept; none is reported as public. |
| No | Remote, no login | Open Source Security: CVSS vector shows PR:L, so an account is required. |
| No | Full takeover | Open Source Security: CVSS shows low confidentiality impact and no integrity or availability impact; not code execution or admin takeover. |
| No | Secrets exposed | Open Source Security: the advisory reports no stolen credentials, keys, configs or data. |
| No | Supply chain | Open Source Security: a normal authentication bypass bug in legitimate code, not malicious code shipped through a trusted channel. |
| No | No fix yet | Open Source Security: affected versions are 3.0.1 before 3.0.2, so a fixed version (3.0.2) is available. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on the oss-security mailing list
Open Source Security
CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files
Source
CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files ↗ Open Source Security · 3h ago
First seen · 1 source · Full story page · How tiers are decided