CVE-2026-49268

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 2.2.1 Apache Shiro versions prior to 3.0.0-alpha-2

Description A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction within the DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without escaping RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially leading to authentication bypass or user impersonation.

Recommendations Upgrade to version 2.2.1 or later. Upgrade to version 3.0.0-alpha-2 or later.