CVE-2026-56091Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context. Upgrade to version 3.0.0 or later, which fixes the issue.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://lists.apache.org/thread/onmtxmy2qonbpx7xlw3o34x8sctv47r7

Weakness type (CWE)

CWE-289

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Full discourse3 posts

Open Source Security mailing list@oss_security91d
Disclosure
CVE-2026-56091: Apache Shiro: Authentication bypass in Guice-Web integration https://www.openwall.com/lists/oss-security/2026/06/24/7 CVE-2026-56130: Apache Shiro: Remember-me cookie isn't checked for expiry on the server https://www.openwall.com/lists/oss-security/2026/06/24/8
Post summary
The snippet announces two new Apache Shiro vulnerabilities: an authentication bypass in Guice-Web integration (CVE-2026-56091) and a server‑side expiry check omission for remember‑me cookies (CVE-2026-56130).
00010176
4.6K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-56091 When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability … https://www.cve.org/CVERecord?id=CVE-2026-56091 ----- Traducción: CVE-2026-56091 Al … http://infoflow.cloud`
Post summary
The tweet reports a newly disclosed CVE (CVE-2026-56091) that allows authentication bypass in Apache Shiro when using shiro-guice, but it does not mention a PoC, exploit, active exploitation, or patch.
0000032
89 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-56091 When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability … https://www.cve.org/CVERecord?id=CVE-2026-56091
Post summary
The CVE-2026-56091 vulnerability allows authentication bypass in Apache Shiro’s shiro‑guice module via a specially crafted HTTP request.
00000860
57.7K followersView on X

Explore more

Back to dashboard