Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

Summary

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

Timeline

1. Feb 3, 2021, 4:55 PM UTCCVE published
2. Aug 4, 2024, 2:00 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Apache Shiro

  before 1.7.1

• org.apache.shiro:shiro-webMaven

  fixed in 1.7.1

• org.apache.shiro:shiro-springMaven

  fixed in 1.7.1

• org.apache.shiro:shiro-spring-boot-starterMaven

  fixed in 1.7.1

References 9