CVE-2026-23903 is an authentication bypass vulnerability in Apache Shiro versions prior to 2.0.7. This flaw allows unauthorized access to static files on case-insensitive file systems, such as macOS, by manipulating the filename's case in requests. Rated Medium severity (CVSS 5.3), it requires no user interaction or privileges, potentially leading to information disclosure (CWE-289). There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.0.7CPE matchmatch criteria | cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Apache Shiro has an Authentication Bypass
Feb 9, 2026org.apache.shiro/shiro-web: Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
Feb 9, 2026CVE-2026-23903: Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems
Feb 8, 2026