CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting

The Brief

Apache Shiro principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting (XSS).
Source gives a CVSS 4.0 base score of 2.1 (low), with low privileges required and user interaction needed.
Affected: org.apache.shiro:shiro-web before 3.0.2, and org.apache.shiro:shiro-jakarta-ee (the affected range is cut off in the source).

Why it matters

Applications that render Shiro principal tags in JSP or Jakarta Faces pages can let attacker-controlled user data run as script in other users' browsers, so affected apps should be patched.

Who’s affected

Teams using Apache Shiro shiro-web before 3.0.2
Teams using org.apache.shiro:shiro-jakarta-ee with Jakarta Pages or Jakarta Faces principal tags

What to do

Upgrade Apache Shiro (shiro-web and shiro-jakarta-ee) to 3.0.2 or later

Apache Shiro before 3.0.2
Apache Shiro 3.0.2
CVE-2026-129320
#security
#xss
#apache-shiro
#java
#jakarta-ee
#cve

Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 2.1 (low) CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/S:N/AU:N/V:D/RE:L/U:Green Affected versions: - Apache Shiro (org.apache.shiro:shiro-web) before 3.0.2 - Apache Shiro (org.apache.shiro:shiro-jakarta-ee)…

Read the full story at seclists.org ↗

Timeline

Nov 13
Vulnerability disclosed on the oss-security mailing list by Lenny Primak
Nov 14 · 1:41 AM
Open Source Security
CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and Jakarta Faces do not escape output, allowing cross-site scripting