---
id: "CVE-2026-129349"
page: "https://infrastack.ai/live/CVE-2026-129349"
kind: "vulnerability"
aliases: ["CVE-2026-129349"]
title: "Apache Shiro: cached LDAP logins accept any password for known users"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-shiro", "java", "jndi", "ldap", "package"]
not_affected_if: ["caching-disabled", "default-config", "non-ldap-realm"]
published_at: "2026-11-15T10:16:53+00:00"
first_seen_at: "2026-11-15T10:34:26+00:00"
updated_at: "2026-11-15T10:35:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129349", "first_seen_at": "2026-11-15T10:34:26+00:00"}]
exploit_sources: []
---

# Apache Shiro: cached LDAP logins accept any password for known users

Link for people: https://infrastack.ai/live/CVE-2026-129349 (this .md is for agents)

When authentication caching is enabled on Shiro's DefaultLdapRealm, a successful login is cached and later logins for that user accept any password. An attacker who knows a valid username can sign in as that user without the password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `authenticationCachingEnabled` set to `true` on a `DefaultLdapRealm` or `JndiLdapRealm` in Shiro configuration (ini files, Spring or Java config).
- Check the Apache Shiro version in use, for example `mvn dependency:tree | grep shiro` or the shiro-core version in the lockfile; affected versions are through `3.0.0`.

## Fix

- Apache Shiro: upgrade to `3.0.1` or later, which no longer installs AllowAllCredentialsMatcher by default.
- Alternatively, keep authentication caching disabled on the LDAP realm (the default), or configure a credentials matcher such as SimpleCredentialsMatcher.

## Timeline

- 2026-11-15T10:34:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129349

## From the sources

When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password.
A cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher installed by default in DefaultLdapRealm accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user.
This issue affects all Apache Shiro versions through 3.0.0, only when using DefaultLdapRealm (or JndiLdapRealm) with authenticationCachingEnabled set to true, which is not the default.

Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing AllowAllCredentialsMatcher by default.
Alternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies credentials against the cached authentication info.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_