CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files

The Brief

Apache Shiro has a case-insensitive path matching issue in the default configuration of ShiroFilterFactoryBean that allows authentication bypass for static files.
The affected package is org.apache.shiro:shiro-spring from 3.0.1 before 3.0.2.
The source rates the issue CVSS 4.0 2.3 (low) and describes it as related to the fix for CVE-2026-23903.

Why it matters

Applications using shiro-spring 3.0.1 that protect static files with Shiro path rules may serve those files without authentication.

Who’s affected

Teams running org.apache.shiro:shiro-spring 3.0.1

What to do

Upgrade org.apache.shiro:shiro-spring to 3.0.2 or later.

Apache Shiro shiro-spring 3.0.1
Apache Shiro shiro-spring 3.0.2
CVE-2026-114737
#security
#java
#authentication
#apache-shiro
#vulnerability

Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 2.3 (low) CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/V:D/RE:L/U:Green Affected versions: - Apache Shiro (org.apache.shiro:shiro-spring) 3.0.1 before 3.0.2 Description: The fix for CVE-2026-23903…

Read the full story at seclists.org ↗

Timeline

Nov 13
Vulnerability disclosed on the oss-security mailing list
Nov 14 · 1:39 AM
Open Source Security
CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files