CVE-2026-56091: Apache Shiro Auth Bypass Vulnerability

CVE-2026-56091 Overview

CVE-2026-56091 is an authentication bypass vulnerability in Apache Shiro affecting the shiro-guice module when deployed in a web servlet context. A specially crafted HTTP request can bypass authentication controls and reach protected resources. The flaw mirrors the previously disclosed CVE-2020-1957, which affected the shiro-spring module, indicating an unresolved class of path-handling inconsistencies between Shiro and downstream servlet routing. The issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1, when the shiro-guice module is used in a web servlet context. Apache resolved the issue in version 3.0.0. The vulnerability is categorized under [CWE-289] Authentication Bypass by Alternate Name.

Critical Impact
Unauthenticated attackers can bypass Shiro authentication filters and access protected web servlet endpoints by submitting crafted HTTP request paths.

Affected Products

Apache Shiro versions through 2.x with the shiro-guice module in a web servlet context
Apache Shiro 3.0.0-alpha-1 with the shiro-guice module in a web servlet context
Java web applications using Guice-based dependency injection with Shiro security filters

Discovery Timeline

2026-06-25 - CVE CVE-2026-56091 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56091

Vulnerability Analysis

Apache Shiro performs URL-based authorization by matching incoming request paths against filter chain definitions. The shiro-guice module integrates Shiro security into Guice-managed servlet environments. When the servlet container normalizes a request path differently than Shiro's filter chain resolver, an attacker can craft a URI that Shiro treats as an unprotected resource while the servlet dispatcher routes it to a protected handler. This path-confusion pattern enables authentication bypass without credentials. The vulnerability is structurally identical to CVE-2020-1957, which affected the Spring integration. The recurrence in the Guice integration indicates that path normalization logic was not centralized across integration modules.

Root Cause

The root cause is inconsistent URL handling between Shiro's shiro-guice filter and the underlying servlet container. Trailing characters, encoded segments, or non-canonical path components are interpreted differently by each layer. Shiro's filter chain evaluates the raw or partially decoded path and fails to match a protective rule, while the servlet dispatcher resolves the same request to the protected endpoint.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request whose URI contains crafted path elements designed to evade Shiro filter pattern matching. The request reaches the protected resource without triggering the authentication filter. The vulnerability is exploitable remotely against any internet-facing servlet application using shiro-guice. Technical specifics are documented in the Apache Security Mailing List Thread.

Detection Methods for CVE-2026-56091

Indicators of Compromise

HTTP access log entries showing requests to protected endpoints with unusual path encodings, trailing slashes, or semicolon parameters that returned 200 responses without prior authentication
Application logs showing successful access to administrative or restricted handlers from sessions that never invoked Shiro login flows
Repeated probing requests against known Shiro-protected URL patterns from a single source IP within a short time window

Detection Strategies

Inventory all Java applications and identify those using org.apache.shiro:shiro-guice dependencies through software composition analysis
Correlate web access logs with Shiro authentication events to flag requests reaching protected paths without a preceding authenticated session
Deploy web application firewall rules that normalize URI paths before policy evaluation and block requests where the normalized path differs materially from the raw path

Monitoring Recommendations

Enable verbose Shiro filter chain logging to record which filters processed each request and the resolved path used for matching
Monitor for HTTP 200 responses on endpoints that should require authentication, alerting when no JSESSIONID or Shiro session cookie is present
Track unusual request patterns containing ;, %2F, %2E, double slashes, or trailing path artifacts targeting servlet routes

How to Mitigate CVE-2026-56091

Immediate Actions Required

Upgrade Apache Shiro to version 3.0.0 or later, which contains the official fix for the shiro-guice path handling defect
Audit application dependency trees for transitive inclusion of vulnerable Shiro versions through Maven or Gradle dependency reports
Restrict network access to affected applications until patching is complete, especially for administrative endpoints

Patch Information

Apache Shiro 3.0.0 resolves CVE-2026-56091 by correcting path normalization in the shiro-guice web servlet integration. Upgrade the org.apache.shiro:shiro-guice and related Shiro artifacts to 3.0.0 or later. Review the Apache Security Mailing List Thread for the official advisory and version coordinates.

Workarounds

Place a reverse proxy or web application firewall in front of the application that canonicalizes URIs before they reach the servlet container
Add defense-in-depth authorization checks within protected controllers or Guice interceptors so authentication is verified at the handler level
Disable or remove the shiro-guice module if it is not strictly required, falling back to programmatic authorization checks in the affected application

bash

# Maven dependency upgrade example
mvn versions:use-dep-version -Dincludes=org.apache.shiro:shiro-guice -DdepVersion=3.0.0 -DforceVersion=true
mvn dependency:tree | grep shiro