Security · High impactFan score 65 · Tier A
CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled
The Brief
- CVE-2026-129349 affects Apache Shiro's DefaultLdapRealm when authentication caching is enabled.
- The source reports that the realm accepts any password in this configuration.
- Affected versions are shiro-core before 3.0.1, and the source rates the issue CVSS 4.0 9.1 (critical).
Why it matters
Applications using Shiro's LDAP realm with authentication caching may let attackers log in with any password, bypassing authentication entirely.
Who’s affected
- Apache Shiro users of DefaultLdapRealm with authentication caching enabled
- Java applications depending on org.apache.shiro:shiro-core before 3.0.1
What to do
- Upgrade org.apache.shiro:shiro-core to 3.0.1 or later
- Review whether DefaultLdapRealm authentication caching is enabled in your application
- Apache Shiro before 3.0.1
- CVE-2026-129349
- #security
- #apache-shiro
- #ldap
- #authentication
- #vulnerability
- #java
Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 9.1 (critical) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:L/U:Red Affected versions: - Apache Shiro (org.apache.shiro:shiro-core) before 3.0.1 Description: When authentication caching is…
Timeline
Vulnerability posted to the oss-sec mailing list by Lenny Primak
Open Source Security
CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled