Vulnerability · low · CVSS 2.3
CVE-2026-129347: Apache Shiro empty stored credential matches empty password
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Applications using Apache Shiro before 3.0.2 with empty stored credentials
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade org.apache.shiro:shiro-core to 3.0.2 or later
The Brief
- Apache Shiro before 3.0.2 has a vulnerability where an empty stored credential matches an empty submitted password.
- The issue is tracked as CVE-2026-129347 and was posted to oss-sec by Lenny Primak on Nov 13.
- The CVSS 4.0 base score is 2.3 (low).
Why it matters
Applications that use Apache Shiro before 3.0.2 and store empty credentials could accept an empty password as valid.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Shiro is a Java security framework that developers build applications with. |
| No | Core infrastructure | Judgment: a single Java authentication framework, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Shiro is a widely used Java framework across many teams. |
| No | Exploited in the wild | Open Source Security: advisory reports the flaw only; no observed attacks mentioned. |
| No | Public exploit | Open Source Security: advisory describes the flaw; no published exploit or PoC mentioned. |
| No | Remote, no login | Open Source Security: CVSS PR:L requires low privileges, so credentials are needed. |
| No | Full takeover | Open Source Security: CVSS impacts are low confidentiality and integrity; no admin or code execution reported. |
| No | Secrets exposed | Open Source Security: advisory reports no stolen or exposed credentials or data. |
| No | Supply chain | Open Source Security: a normal authentication bug in legitimate code; no malicious shipping reported. |
| No | No fix yet | Open Source Security: affected versions are before 3.0.2, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on oss-sec by Lenny Primak
Open Source Security
CVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password
Source
CVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided