CVE-2026-23903: Apache Shiro Auth Bypass Vulnerability

CVE-2026-23903 Overview

An Authentication Bypass by Alternate Name vulnerability has been identified in Apache Shiro, a powerful and easy-to-use Java security framework. This vulnerability allows attackers to bypass authentication filters when accessing static files on case-insensitive filesystems by manipulating the case of filenames in HTTP requests.

Critical Impact

Attackers can bypass Shiro's authentication filters and access protected static files by varying the case of the filename in requests, potentially exposing sensitive resources.

Affected Products

• Apache Shiro versions before 2.0.7
• Applications serving static files from case-insensitive filesystems (e.g., default macOS setup)
• Configurations using only lower-case filter patterns

Discovery Timeline

• February 9, 2026 - CVE-2026-23903 published to NVD
• February 11, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23903

Vulnerability Analysis

This authentication bypass vulnerability (CWE-289) exploits a discrepancy between how Apache Shiro processes URL filter patterns and how case-insensitive filesystems handle file lookups. When Shiro is configured with lower-case filter patterns (the common default), it performs case-sensitive matching against incoming requests. However, on case-insensitive filesystems like macOS's default HFS+ or APFS, file access is case-insensitive.

This mismatch creates a security gap where an attacker can request a protected resource using a different case than what is specified in the Shiro filter configuration. For example, if /protected/secret.txt is protected by a filter, requesting /Protected/SECRET.txt would bypass the filter while still successfully retrieving the file from the filesystem.

Root Cause

The root cause lies in Apache Shiro's default case-sensitive filter chain matching behavior when deployed on case-insensitive filesystems. The security framework assumes that /admin/config.json and /Admin/Config.JSON are different resources, while the underlying filesystem treats them as identical. This architectural assumption fails to account for environments where filesystem case sensitivity differs from URL case sensitivity.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP requests with varied-case filenames to access protected static resources. The attack is straightforward to execute—simply modifying the case of characters in the URL path can bypass authentication controls designed to protect sensitive static files.

For instance, if a Shiro configuration protects all files under /admin/** with an authentication filter, an attacker might successfully access resources by requesting /Admin/sensitive-config.xml or /ADMIN/credentials.json on systems with case-insensitive filesystems.

Detection Methods for CVE-2026-23903

Indicators of Compromise

• HTTP access logs showing requests with unusual or mixed-case URL paths to static resources
• Successful responses (HTTP 200) for static file requests that don't match the expected case patterns
• Multiple requests for the same resource using different case variations in short timeframes

Detection Strategies

• Implement log analysis rules to detect case variations in requests for protected static resource paths
• Monitor for patterns of sequential requests to the same logical resource with different casing
• Configure web application firewalls (WAF) to normalize URL case before processing or alert on case anomalies

Monitoring Recommendations

• Enable detailed access logging for all static file requests in your application
• Create alerts for access to sensitive directories using non-standard casing
• Periodically audit Shiro filter configurations against actual filesystem case sensitivity settings

How to Mitigate CVE-2026-23903

Immediate Actions Required

• Upgrade Apache Shiro to version 2.0.7 or later immediately
• Review your deployment environment to identify if case-insensitive filesystems are in use
• Audit existing Shiro filter configurations for case-sensitivity gaps
• Enable the new case-insensitive filter matching parameter as described below

Patch Information

Apache has released version 2.0.7 which addresses this vulnerability by introducing new configuration parameters that enable case-insensitive filter chain matching. Users should upgrade to this version or later. The upcoming Shiro 3.0.0 release will make case-insensitive matching the default behavior.

For detailed patch information, refer to the Apache Mailing List Thread.

Workarounds

• Enable case-insensitive filter matching using the configuration options below
• Deploy static files on a case-sensitive filesystem if possible
• Implement additional access controls at the web server level that perform case-insensitive URL matching
• Consider using a reverse proxy to normalize URL case before requests reach Shiro

# Configuration example for shiro.ini
filterChainResolver.caseInsensitive = true

# Configuration example for application.properties (Spring Boot)
shiro.caseInsensitive=true