{"id":"CVE-2026-129349","kind":"vulnerability","aliases":["CVE-2026-129349"],"related":[],"title":"Apache Shiro: cached LDAP logins accept any password for known users","description":"When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password.\nA cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher installed by default in DefaultLdapRealm accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user.\nThis issue affects all Apache Shiro versions through 3.0.0, only when using DefaultLdapRealm (or JndiLdapRealm) with authenticationCachingEnabled set to true, which is not the default.\n\nMitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing AllowAllCredentialsMatcher by default.\nAlternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies credentials against the cached authentication info.","summary":"When authentication caching is enabled on Shiro's DefaultLdapRealm, a successful login is cached and later logins for that user accept any password. An attacker who knows a valid username can sign in as that user without the password.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-shiro","java","jndi","ldap","package"],"not_affected_if":["caching-disabled","default-config","non-ldap-realm"],"how_to_check":"- Look for `authenticationCachingEnabled` set to `true` on a `DefaultLdapRealm` or `JndiLdapRealm` in Shiro configuration (ini files, Spring or Java config).\n- Check the Apache Shiro version in use, for example `mvn dependency:tree | grep shiro` or the shiro-core version in the lockfile; affected versions are through `3.0.0`.","fix":"- Apache Shiro: upgrade to `3.0.1` or later, which no longer installs AllowAllCredentialsMatcher by default.\n- Alternatively, keep authentication caching disabled on the LDAP realm (the default), or configure a credentials matcher such as SimpleCredentialsMatcher.","status":"open","published_at":"2026-11-15T10:16:53+00:00","first_seen_at":"2026-11-15T10:34:26+00:00","triaged_at":"2026-11-15T10:35:25+00:00","updated_at":"2026-11-15T10:35:25+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-15T10:35:25Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Shiro: upgrade to `3.0.1` or later, which no longer installs AllowAllCredentialsMatcher by default.\n- Alternatively, keep authentication caching disabled on the LDAP realm (the default), or configure a credentials matcher such as SimpleCredentialsMatcher.","reach":"network","title":"Apache Shiro: cached LDAP logins accept any password for known users","impact":"high","summary":"When authentication caching is enabled on Shiro's DefaultLdapRealm, a successful login is cached and later logins for that user accept any password. An attacker who knows a valid username can sign in as that user without the password.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-shiro","java","ldap","jndi"],"confidence":0.85,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in as any known user without the password","analyst_note":"","how_to_check":"- Look for `authenticationCachingEnabled` set to `true` on a `DefaultLdapRealm` or `JndiLdapRealm` in Shiro configuration (ini files, Spring or Java config).\n- Check the Apache Shiro version in use, for example `mvn dependency:tree | grep shiro` or the shiro-core version in the lockfile; affected versions are through `3.0.0`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","non-ldap-realm","caching-disabled"],"who_is_affected":"Only applications that use Apache Shiro's DefaultLdapRealm or JndiLdapRealm with authentication caching turned on, which is not the default. The flaw is in the authentication path itself, so an application with that setup accepts any password for a user who logged in successfully once. Applications using other realms, or LDAP realms with caching off, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000821,"input_tokens":4778,"output_tokens":686,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-129349':14A,17A '-2026':13A,16A '3.0.0':126C '3.0.1':147C 'accept':6A,45B,102C 'affect':120C 'allow':105C 'allowallcredentialsmatch':96C,158C 'altern':161C 'apach':1A,19B,122C 'apache-shiro':18B 'attack':49B,107C 'authent':26B,65C,89C,114C,163C,187C 'authenticationcachingen':134C 'bind':93C 'cach':3A,27B,38B,66C,88C,164C,186C 'configur':174C 'credenti':104C,176C,183C 'cve':12A,15A 'default':99C,142C,160C,172C 'defaultldaprealm':33B,70C,101C,130C 'disabl':162C 'enabl':29B,68C 'fix':151C 'info':188C 'instal':97C,157C 'issu':119C,153C 'java':21B 'jndi':22B 'jndildaprealm':132C 'know':51B,109C 'known':10A 'later':40B,149C 'ldap':4A,23B,92C,167C 'log':74C 'login':5A,36B,41B,79C 'longer':156C 'matcher':177C 'mitig':143C 'packag':24B 'password':8A,47B,63B,86C 'realm':168C 'set':135C 'shiro':2A,20B,31B,123C 'sign':56B 'simplecredentialsmatch':180C 'skip':90C 'subsequ':78C 'succeed':83C 'success':35B,76C 'true':137C 'upgrad':144C 'use':129C 'user':11A,44B,60B,73C,82C,117C 'usernam':54B,112C 'valid':53B,111C 'verifi':182C 'version':124C,146C 'without':61B","nicknames":[],"mitigations":[],"who_affected":"Only applications that use Apache Shiro's DefaultLdapRealm or JndiLdapRealm with authentication caching turned on, which is not the default. The flaw is in the authentication path itself, so an application with that setup accepts any password for a user who logged in successfully once. Applications using other realms, or LDAP realms with caching off, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheshiro","critical","java","jndi","ldap","package"],"campaign_type":null,"search_a":"'-129349':14A,17A '-2026':13A,16A 'accept':6A 'apach':1A 'cach':3A 'cve':12A,15A 'known':10A 'ldap':4A 'login':5A 'password':8A 'shiro':2A 'user':11A","search_b":"'accept':45B 'apach':19B 'apache-shiro':18B 'attack':49B 'authent':26B 'cach':27B,38B 'defaultldaprealm':33B 'enabl':29B 'java':21B 'jndi':22B 'know':51B 'later':40B 'ldap':23B 'login':36B,41B 'packag':24B 'password':47B,63B 'shiro':20B,31B 'sign':56B 'success':35B 'user':44B,60B 'usernam':54B 'valid':53B 'without':61B","search_c":"'3.0.0':126C '3.0.1':147C 'accept':102C 'affect':120C 'allow':105C 'allowallcredentialsmatch':96C,158C 'altern':161C 'apach':122C 'attack':107C 'authent':65C,89C,114C,163C,187C 'authenticationcachingen':134C 'bind':93C 'cach':66C,88C,164C,186C 'configur':174C 'credenti':104C,176C,183C 'default':99C,142C,160C,172C 'defaultldaprealm':70C,101C,130C 'disabl':162C 'enabl':68C 'fix':151C 'info':188C 'instal':97C,157C 'issu':119C,153C 'jndildaprealm':132C 'know':109C 'later':149C 'ldap':92C,167C 'log':74C 'login':79C 'longer':156C 'matcher':177C 'mitig':143C 'password':86C 'realm':168C 'set':135C 'shiro':123C 'simplecredentialsmatch':180C 'skip':90C 'subsequ':78C 'succeed':83C 'success':76C 'true':137C 'upgrad':144C 'use':129C 'user':73C,82C,117C 'usernam':112C 'valid':111C 'verifi':182C 'version':124C,146C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T10:16:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129349","severity":null,"published_at":"2026-11-15T10:16:53+00:00","modified_at":"2026-11-15T10:16:53+00:00","first_seen_at":"2026-11-15T10:34:26+00:00","fetched_at":"2026-11-15T10:34:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}