# CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/698) · 2026-11-14 · Security
Page: https://themorning.dev/story/cve-2026-114737-apache-shiro-incorrect-default-for-case-insensitive-path-matchin-185fc4a266531a5a
Kind: security · Impact: low

## In brief

- Apache Shiro has a case-insensitive path matching issue in the default configuration of ShiroFilterFactoryBean that allows authentication bypass for static files.
- The affected package is org.apache.shiro:shiro-spring from 3.0.1 before 3.0.2.
- The source rates the issue CVSS 4.0 2.3 (low) and describes it as related to the fix for CVE-2026-23903.

## Why it matters

Applications using shiro-spring 3.0.1 that protect static files with Shiro path rules may serve those files without authentication.

## What to do

- Upgrade org.apache.shiro:shiro-spring to 3.0.2 or later.

## Versions

- Apache Shiro shiro-spring 3.0.1
- Apache Shiro shiro-spring 3.0.2

## CVEs

- CVE-2026-114737

## Timeline

- 2026-11-13: Vulnerability disclosed on the oss-security mailing list

## Coverage

- [CVE-2026-114737: Apache Shiro: Incorrect default for case-insensitive path matching in ShiroFilterFactoryBean allows auth bypass for static files](https://seclists.org/oss-sec/2026/q4/698) — Open Source Security, 2026-11-14

Tags: security, java, authentication, apache-shiro, vulnerability

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev