PT-2026-7016 · Apache · Apache Shiro

4Ra1N + 2 · Published 2026-01-01 · Updated 2026-05-18 · CVE-2026-23901

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions 1.* Apache Shiro versions 2.* through 2.0.6

Description An observable timing discrepancy exists in Apache Shiro. Before version 2.0.7, the code paths used for non-existent and existing users differ sufficiently, allowing a brute-force attack to determine if a request fails due to an invalid user or an incorrect password by measuring request timing. The most likely attack vector is a local attack. This issue is related to username enumeration, as discussed in the Shiro security model. Brute force attacks can typically be mitigated at the infrastructure level.

Recommendations Upgrade to Apache Shiro version 2.0.7 or later.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CLEANSTART-2026-GH89210

CVE-2026-23901

GHSA-C4QC-4Q9P-M9Q9

Affected Products

Apache Shiro

References · 96

• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-47535 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24823 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2976 · Security Note
• https://ubuntu.com/security/CVE-2026-23901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24970 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44432 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-GH89210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12801 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13009 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11143 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-34462 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-23901 · Security Note