# org.apache.shiro:shiro-core (Maven) vulnerabilities 13 known vulnerabilities (2 critical, 1 high, 2 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.0.1 (Aug 23, 2026): no advisory affects it - Newest unaffected release: 3.0.1 (Aug 23, 2026), the latest release - Dependents: 65 - Releases: 48 since 1.0.0-incubating (May 21, 2010) - Registry: https://central.sonatype.com/artifact/org.apache.shiro/shiro-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-56130: 1.2.4 to 3.0.0-alpha-1 (3.0.0 is outside it) - CVE-2026-49268: 1.0.0-incubating to 2.2.0 (2.2.1 is outside it); 3.0.0-alpha-1 (3.0.0 is outside it) - CVE-2026-43827: 1.0.0-incubating to 2.1.0 (2.2.0 is outside it); 3.0.0-alpha-1 (3.0.0 is outside it) - CVE-2026-23901: 1.0.0-incubating to 2.0.6 (2.1.0 is outside it) - CVE-2023-46749: 1.0.0-incubating to 1.12.0 (1.13.0 is outside it); 2.0.0-alpha-1 to 2.0.0-alpha-3 (2.0.0-alpha-4 is outside it) - CVE-2022-40664: 1.0.0-incubating to 1.9.1 (1.10.0 is outside it) - CVE-2022-32532: 1.0.0-incubating to 1.9.0 (1.9.1 is outside it) - CVE-2021-41303: 1.0.0-incubating to 1.7.1 (1.8.0 is outside it) - CVE-2020-13933: 1.0.0-incubating to 1.5.3 (1.6.0 is outside it) - CVE-2020-11989: 1.0.0-incubating to 1.5.2 (1.5.3 is outside it) - CVE-2020-1957: 1.0.0-incubating to 1.5.1 (1.5.2 is outside it) - CVE-2019-12422: 1.0.0-incubating to 1.4.1 (1.4.2 is outside it) - CVE-2016-4437: 1.0.0-incubating to 1.2.4 (1.2.5 is outside it) ## Advisories (13) ### [CVE-2026-56130](https://cve.now/CVE-2026-56130): Apache Shiro: Remember-me cookie isn't checked for expiry on the server - Severity: Low 2.0 - Published: Jun 25, 2026 - Affected: from 1.2.4, fixed in 3.0.0. - Fixed in 3.0.0 (released Jun 20, 2026, 5 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2026-49268](https://cve.now/CVE-2026-49268): Apache Shiro: LDAP DN Injection in DefaultLdapRealm - Severity: High 8.8 - Published: Jun 17, 2026 - Affected: through 2.2.0; from 3.0.0-alpha-0, through 3.0.0-alpha-1; fixed in 2.2.1; from 3.0.0-alpha-0, fixed in 3.0.0-alpha-2. - Fixed in 2.2.1 (released Jun 14, 2026, 3 days before disclosure) and 3.0.0 (released Jun 20, 2026, 3 days after disclosure, the advisory names 3.0.0-alpha-2, which was never published). - The latest release, 3.0.1, is not affected. ### [CVE-2026-43827](https://cve.now/CVE-2026-43827): Apache Shiro: Session fixation: new session is not created after login by default - Severity: Medium 5.9 - Published: May 25, 2026 - Affected: from 1.0, through 2.1.0; from 3.0.0-alpha-0, through 3.0.0-alpha-1; from 1.0.0-incubating, fixed in 2.2.0; from 3.0.0-alpha-1, fixed in 3.0.0-alpha-2. - Fixed in 2.2.0 (released May 14, 2026, 11 days before disclosure) and 3.0.0 (released Jun 20, 2026, 26 days after disclosure, the advisory names 3.0.0-alpha-2, which was never published). - The latest release, 3.0.1, is not affected. ### [CVE-2026-23901](https://cve.now/CVE-2026-23901): Apache Shiro: Brute force attack possible to determine valid user names - Severity: Low 1.0 - Published: Feb 10, 2026 - Affected: fixed in 2.0.7; fixed in 2.1.0. - Fixed in 2.1.0 (released Feb 4, 2026, 6 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2023-46749](https://cve.now/CVE-2023-46749): Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when… - Severity: Medium 6.5 - Published: Jan 15, 2024 - Affected: fixed in 1.13.0; from 2.0.0alpha1, fixed in 2.0.0-alpha4. - Fixed in 1.13.0 (released Oct 31, 2023, 76 days before disclosure) and 2.0.0-alpha-4 (released Nov 7, 2023, 69 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2022-40664](https://cve.now/CVE-2022-40664): Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher - Severity: Critical 9.8 - Published: Oct 12, 2022 - Affected: fixed in 1.10.0. - Fixed in 1.10.0 (released Oct 7, 2022, 5 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2022-32532](https://cve.now/CVE-2022-32532): Authentication Bypass Vulnerability - Severity: Unrated - Published: Jun 28, 2022 - Affected: fixed in 1.9.1. - Fixed in 1.9.1 (released Jun 23, 2022, 5 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2021-41303](https://cve.now/CVE-2021-41303): Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass - Severity: Unrated - Published: Sep 17, 2021 - Affected: fixed in 1.8.0. - Fixed in 1.8.0 (released Aug 23, 2021, 25 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2020-13933](https://cve.now/CVE-2020-13933): Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. - Severity: Unrated - Published: Aug 17, 2020 - Affected: fixed in 1.6.0. - Fixed in 1.6.0 (released Aug 11, 2020, 6 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2020-11989](https://cve.now/CVE-2020-11989): Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an… - Severity: Unrated - Published: Jun 22, 2020 - Affected: fixed in 1.5.3. - Fixed in 1.5.3 (released Apr 26, 2020, 57 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2020-1957](https://cve.now/CVE-2020-1957): Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an… - Severity: Unrated - Published: Mar 25, 2020 - Affected: fixed in 1.5.2. - Fixed in 1.5.2 (released Mar 18, 2020, 7 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2019-12422](https://cve.now/CVE-2019-12422): Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack. - Severity: Unrated - Published: Nov 18, 2019 - Affected: fixed in 1.4.2. - Fixed in 1.4.2 (released Nov 8, 2019, 10 days before disclosure). - The latest release, 3.0.1, is not affected. ### [CVE-2016-4437](https://cve.now/CVE-2016-4437): Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbit - Severity: Critical 9.8 · KEV - Published: Jun 7, 2016 - Affected: fixed in 1.2.5. - Fixed in 1.2.5 (released May 19, 2016, 19 days before disclosure). - The latest release, 3.0.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.shiro:shiro-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.