Live › vulnerability › CVE-2026-56091
The shiro-guice module of Apache Shiro can be bypassed by a specially crafted HTTP request in a web servlet context. An attacker can reach protected pages without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:24 UTC, 1h before NVD. All times on this page are UTC.
Only applications that use the shiro-guice module of Apache Shiro inside a web servlet context are exposed. The issue is similar to CVE-2020-1957 but affects shiro-guice instead of shiro-spring. Applications that use shiro-spring or do not use shiro-guice in a servlet context are not stated to be affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.shiro:shiro-guice | maven | >= 2.0.0, < 3.0.0 | 3.0.0 |
org.apache.shiro:shiro-guice (for example in pom.xml or the Maven dependency tree).shiro-guice is between 2.0.0 and 3.0.0 (exclusive of ).3.0.03.0.0-alpha-1 is affected only when shiro-guice is used in a web servlet context.org.apache.shiro:shiro-guice to 3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.
This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module instead of the shiro-spring module.
This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using shiro-guice module in a web servlet context.
Upgrade to version 3.0.0 or later, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-56091")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.