SecurityFan score 21 · Tier C

CVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password

oss-security · 2h ago

The Brief

Apache Shiro before 3.0.2 has a vulnerability where an empty stored credential matches an empty submitted password.
The issue is tracked as CVE-2026-129347 and was posted to oss-sec by Lenny Primak on Nov 13.
The CVSS 4.0 base score is 2.3 (low).

Why it matters

Applications that use Apache Shiro before 3.0.2 and store empty credentials could accept an empty password as valid.

Who’s affected

Projects using org.apache.shiro:shiro-core before 3.0.2

What to do

Upgrade org.apache.shiro:shiro-core to 3.0.2 or later

Apache Shiro before 3.0.2
CVE-2026-129347
#apache-shiro
#authentication
#vulnerability
#java
#password-handling

Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 2.3 (low) CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Green Affected versions: - Apache Shiro (org.apache.shiro:shiro-core) before 3.0.2 Description: `DefaultPasswordService` and…

Read the full story at seclists.org ↗

Timeline

Nov 13
Vulnerability disclosed on oss-sec by Lenny Primak
Nov 14 · 5:56 AM
Open Source Security
CVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password