{"id":"CVE-2026-56091","kind":"vulnerability","aliases":["CVE-2026-56091","GHSA-qj64-jj84-w38j"],"related":[],"title":"Apache Shiro shiro-guice module vulnerable to authentication bypass","description":"When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass.\nThis vulnerability is similar to  https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module.\n\nThis issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context.\n\nUpgrade to version 3.0.0 or later, which fixes the issue.","summary":"The shiro-guice module of Apache Shiro can be bypassed by a specially crafted HTTP request in a web servlet context. An attacker can reach protected pages without logging in.","severity":"high","cvss":8.2,"epss":0.00669,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.shiro:shiro-guice","fixed":["3.0.0"],"affected":">= 2.0.0, < 3.0.0","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["apache-shiro","cwe-289","java","maven","package","servlet","shiro-guice"],"not_affected_if":["no-shiro-guice","non-servlet-context"],"how_to_check":"- Check whether the project depends on `org.apache.shiro:shiro-guice` (for example in `pom.xml` or the Maven dependency tree).\n- Confirm the resolved version of `shiro-guice` is between `2.0.0` and `3.0.0` (exclusive of `3.0.0`).\n- Note that `3.0.0-alpha-1` is affected only when shiro-guice is used in a web servlet context.","fix":"- Upgrade `org.apache.shiro:shiro-guice` to `3.0.0` or later.","status":"open","published_at":"2026-06-25T09:16:46+00:00","first_seen_at":"2026-11-03T21:24:57+00:00","triaged_at":"2026-11-03T21:28:53+00:00","updated_at":"2026-11-03T22:07:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T21:28:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.apache.shiro:shiro-guice` to `3.0.0` or later.","reach":"internet","title":"Apache Shiro shiro-guice: crafted HTTP request bypasses authentication in servlet apps","impact":"high","summary":"The shiro-guice module of Apache Shiro can be bypassed by a specially crafted HTTP request in a web servlet context. An attacker can reach protected pages without logging in.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-shiro","shiro-guice","maven","servlet"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker bypasses authentication to reach protected web resources","analyst_note":"","how_to_check":"- Check whether the project depends on `org.apache.shiro:shiro-guice` (for example in `pom.xml` or the Maven dependency tree).\n- Confirm the resolved version of `shiro-guice` is between `2.0.0` and `3.0.0` (exclusive of `3.0.0`).\n- Note that `3.0.0-alpha-1` is affected only when shiro-guice is used in a web servlet context.","plain_action":"","needs_analyst":false,"not_affected_if":["no-shiro-guice","non-servlet-context"],"who_is_affected":"Only applications that use the shiro-guice module of Apache Shiro inside a web servlet context are exposed. The issue is similar to CVE-2020-1957 but affects shiro-guice instead of shiro-spring. Applications that use shiro-spring or do not use shiro-guice in a servlet context are not stated to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4285,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':133C '-2026':12A,20A '-289':30B '-56091':13A,21A '/cverecord':103C '/cverecord?id=cve-2020-1957':100C '2':128C '3.0.0':131C,149C 'affect':107C,122C 'alpha':132C 'apach':1A,27B,44B,70C,124C 'apache-shiro':26B 'attack':61B 'authent':9A,91C 'bypass':10A,48B,92C 'caus':89C 'context':59B,82C,145C 'craft':52B,85C 'cve':11A,19A 'cwe':29B 'except':104C 'fix':153C 'ghsa':15A 'ghsa-qj64-jj84-w38j':14A 'guic':5A,37B,41B,76C,111C,139C 'guice':25A 'http':53B,86C 'instead':113C 'issu':121C,155C 'java':31B 'jj84':17A 'later':151C 'log':67B 'maven':32B 'may':88C 'modul':6A,42B,77C,112C,119C,140C 'org.apache.shiro':22A 'packag':33B 'page':65B 'protect':64B 'qj64':16A 'reach':63B 'request':54B,87C 'servlet':34B,58B,81C,144C 'shiro':2A,4A,24A,28B,36B,40B,45B,71C,75C,110C,117C,125C,138C 'shiro-guic':3A,35B,39B,74C,109C,137C 'shiro-guice':23A 'shiro-spr':116C 'similar':96C 'special':51B,84C 'spring':118C 'upgrad':146C 'use':69C,136C 'version':126C,148C 'vulner':7A,94C 'w38j':18A 'web':57B,80C,143C 'without':66B 'www.cve.org':99C,102C 'www.cve.org/cverecord':101C 'www.cve.org/cverecord?id=cve-2020-1957':98C 'x':129C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use the shiro-guice module of Apache Shiro inside a web servlet context are exposed. The issue is similar to CVE-2020-1957 but affects shiro-guice instead of shiro-spring. Applications that use shiro-spring or do not use shiro-guice in a servlet context are not stated to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["orgapacheshiroshiroguice"],"ptokens":["apache","guice","org","shiro"],"labels":["apacheshiro","cwe289","high","java","maven","package","servlet","shiroguice"],"campaign_type":null,"first_public_at":"2026-06-25T09:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:D/RE:L/U:Amber","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-qj64-jj84-w38j","url":"https://github.com/advisories/GHSA-qj64-jj84-w38j","severity":"high","published_at":"2026-06-25T09:31:23+00:00","modified_at":"2026-11-03T21:24:24+00:00","first_seen_at":"2026-11-03T21:24:57+00:00","fetched_at":"2026-11-03T21:30:11+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56091","severity":null,"published_at":"2026-06-25T09:16:46+00:00","modified_at":"2026-10-25T23:10:00+00:00","first_seen_at":"2026-11-03T22:07:19+00:00","fetched_at":"2026-11-03T22:07:19+00:00","note":null}],"documents":[{"id":60960,"url":"https://github.com/apache/shiro/commit/42aa34467ad30f085fc8e003042db0c397fe8d57","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}