CVE-2026-23901 Apache Shiro: Brute force attack possible to determine valid user names
Attackers can enumerate valid usernames via timing discrepancies in Apache Shiro, facilitating targeted brute-force attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-23901?
CVE-2026-23901 is a low-severity vulnerability in Apache Shiro, published on 10 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Observable Timing Discrepancy vulnerability in Apache Shiro.
This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.
Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.
Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password.
The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well.
Typically, brute force attack can be mitigated at the infrastructure level.
Weakness: CWE-208
Which versions are affected by CVE-2026-23901?
2 open source packages ship an affected version, including org.apache.shiro:shiro-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.shiro:shiro-core Maven | All versions | 2.1.0 |
org.apache.shiro:shiro-core Maven | All versions | 2.1.0 |
Products include Apache Shiro.
How do I fix CVE-2026-23901?
Upgrade org.apache.shiro:shiro-core to 2.1.0 or later.
Is CVE-2026-23901 being exploited?
There is no known exploitation of CVE-2026-23901 in the wild and no public exploit code.
Other vulnerabilities in Apache Shiro
- CVE-2023-34478 Path Traversal in Apache Shiro
- CVE-2022-40664 Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
- CVE-2022-32532 Authentication Bypass Vulnerability
- CVE-2021-41303 Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass
- CVE-2020-17523 Authentication bypass in Apache Shiro
Sources
Also known as CLEANSTART-2026-WY81634, CLEANSTART-2026-XU58754, DEBIAN-CVE-2026-23901, ECHO-d58c-d10e-42b1, GHSA-c4qc-4q9p-m9q9, MINI-2xmq-qc58-x2hx and 19 more.