CVE-2026-129349 · Package
NO FIX YET · SEE WHAT TO DO
When authentication caching is enabled on Shiro's DefaultLdapRealm, a successful login is cached and later logins for that user accept any password. An attacker who knows a valid username can sign in as that user without the password.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that use Apache Shiro's DefaultLdapRealm or JndiLdapRealm with authentication caching turned on, which is not the default. The flaw is in the authentication path itself, so an application with that setup accepts any password for a user who logged in successfully once. Applications using other realms, or LDAP realms with caching off, are not affected.
Not affected if caching-disabled, default-config, non-ldap-realm
Who cares apache-shiro, java, jndi, ldap
authenticationCachingEnabled set to true on a DefaultLdapRealm or JndiLdapRealm in Shiro configuration (ini files, Spring or Java config).mvn dependency:tree | grep shiro or the shiro-core version in the lockfile; affected versions are through 3.0.0.3.0.1 or later, which no longer installs AllowAllCredentialsMatcher by default.When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password. A cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher installed by default in DefaultLdapRealm accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user. This issue affects all Apache Shiro versions through 3.0.0, only when using DefaultLdapRealm (or JndiLdapRealm) with authenticationCachingEnabled set to true, which is not the default.
Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing AllowAllCredentialsMatcher by default. Alternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies credentials against the cached authentication info.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.