PT-2026-147440
CVE-2026-129349
·
Published
2026-11-14
·
Updated
2026-11-15
Description by
CVSS 4.0
9.1
CriticalMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red
Name of the Vulnerable Software and Affected Versions
Apache Shiro versions prior to 3.0.1
Description
An authentication bypass exists when using the
DefaultLdapRealm with the authenticationCachingEnabled setting enabled. In this configuration, the framework skips the LDAP server verification for users who have previously authenticated and instead utilizes a default credentials matcher that accepts any password. An attacker can gain unauthorized access by providing only a valid username of a user who has logged in once.Recommendations
Update to version 3.0.1 or later.
Disable the
authenticationCachingEnabled setting to prevent the bypass. Found an issue in the description? Have something to add? Feel free to write us 👾