# CVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/703) · 2026-11-14 · Security
Page: https://themorning.dev/story/cve-2026-129347-apache-shiro-empty-stored-credential-matches-an-empty-submitted-1985c3d54675f915
Kind: security · Impact: low

## In brief

- Apache Shiro before 3.0.2 has a vulnerability where an empty stored credential matches an empty submitted password.
- The issue is tracked as CVE-2026-129347 and was posted to oss-sec by Lenny Primak on Nov 13.
- The CVSS 4.0 base score is 2.3 (low).

## Why it matters

Applications that use Apache Shiro before 3.0.2 and store empty credentials could accept an empty password as valid.

## What to do

- Upgrade org.apache.shiro:shiro-core to 3.0.2 or later

## Versions

- Apache Shiro before 3.0.2

## CVEs

- CVE-2026-129347

## Timeline

- 2026-11-13: Vulnerability disclosed on oss-sec by Lenny Primak

## Coverage

- [CVE-2026-129347: Apache Shiro: Empty stored credential matches an empty submitted password](https://seclists.org/oss-sec/2026/q4/703) — Open Source Security, 2026-11-14

Tags: apache-shiro, authentication, vulnerability, java, password-handling

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev