# CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/705) · 2026-11-14 · Security
Page: https://themorning.dev/story/cve-2026-129349-apache-shiro-defaultldaprealm-accepts-any-password-when-authenti-a28228149d15eda2
Kind: security · Impact: high

## In brief

- CVE-2026-129349 affects Apache Shiro's DefaultLdapRealm when authentication caching is enabled.
- The source reports that the realm accepts any password in this configuration.
- Affected versions are shiro-core before 3.0.1, and the source rates the issue CVSS 4.0 9.1 (critical).

## Why it matters

Applications using Shiro's LDAP realm with authentication caching may let attackers log in with any password, bypassing authentication entirely.

## What to do

- Upgrade org.apache.shiro:shiro-core to 3.0.1 or later
- Review whether DefaultLdapRealm authentication caching is enabled in your application

## Versions

- Apache Shiro before 3.0.1

## CVEs

- CVE-2026-129349

## Timeline

- 2026-11-13: Vulnerability posted to the oss-sec mailing list by Lenny Primak

## Coverage

- [CVE-2026-129349: Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled](https://seclists.org/oss-sec/2026/q4/705) — Open Source Security, 2026-11-14

Tags: security, apache-shiro, ldap, authentication, vulnerability, java

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev