Read the docs
TI-2026-36460 Aliases CVE-2026-49268GHSA-x96m-rh44-vgv8

Apache Shiro: LDAP DN Injection in DefaultLdapRealm

Priority MEDIUM 45CWE-90Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users. This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00512 43rd percentileScored 2026-11-07
Fix Fixed org.apache.shiro:shiro-core (Maven): 2.2.1, 3.0.0-alpha-2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Shiroup to 2.2.0; 3.0.0-alpha-0 – 3.0.0-alpha-1—No fix listedCNA
—org.apache.shiro:shiro-core (Maven)before 2.2.12.2.1Patch availableGHSA-x96m-rh44-vgv8
—org.apache.shiro:shiro-core (Maven)3.0.0-alpha-0 to before 3.0.0-alpha-23.0.0-alpha-2Patch availableGHSA-x96m-rh44-vgv8
  • Apache Shiro VendorApache Affected up to 2.2.0; 3.0.0-alpha-0 – 3.0.0-alpha-1 Fixed in — No fix listed CNA
  • org.apache.shiro:shiro-core (Maven) Vendor— Affected before 2.2.1 Fixed in 2.2.1 Patch available GHSA-x96m-rh44-vgv8
  • org.apache.shiro:shiro-core (Maven) Vendor— Affected 3.0.0-alpha-0 to before 3.0.0-alpha-2 Fixed in 3.0.0-alpha-2 Patch available GHSA-x96m-rh44-vgv8

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*before 2.2.1VulnerableApache
cpe:2.3:a:apache:shiro:3.0.0:alpha1:*:*:*:*:*:*3.0.0 alpha1VulnerableApache
  • cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* Versions before 2.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:shiro:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-x96m-rh44-vgv8 org.apache.shiro:shiro-core (Maven) Fixed in 2.2.1 Advisory →
  • Fix · GHSA-x96m-rh44-vgv8 org.apache.shiro:shiro-core (Maven) Fixed in 3.0.0-alpha-2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49268
  2. 2026-10-03 Alias added: GHSA-x96m-rh44-vgv8
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 3

Other 1

  • TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-13272 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
  • TI-2021-18132 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
  • TI-2022-14167 Authentication bypass in Apache Shiro CVSS 3.1CRITICAL 9.8
  • TI-2020-09649 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
  • TI-2020-10910 Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences