CVE-2026-49268

Overview

Apache Shiro is an open-source Java security framework that performs authentication, authorization, cryptography, and session management for applications ranging from small mobile apps to large web and enterprise systems. Its shiro-core module provides the framework's realm implementations, including the LDAP realms that authenticate users against a directory server.

An authorization bypass vulnerability (CVE-2026-49268) has been identified in Apache Shiro's DefaultLdapRealm, which allows attackers to alter, through LDAP injection, the LDAP distinguished name (DN) used for the authentication bind by including DN special characters in a submitted username, potentially bypassing authentication or impersonating another user.

Per OWASP: LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements using a local proxy. This could result in the execution of arbitrary commands such as granting permissions to unauthorized queries, and content modification inside the LDAP tree.

This issue affects all versions of Apache Shiro through 2.2.0, as well as the 3.0.0-alpha-1 pre-release.

Details

Module Info

• Product: Apache Shiro
• Affected packages: org.apache.shiro:shiro-core
• Affected versions: <2.2.1, 3.0.0-alpha-1
• GitHub repository: https://github.com/apache/shiro
• Published packages: https://central.sonatype.com/artifact/org.apache.shiro/shiro-core
• Package manager: Maven
• Fixed in: NES for Apache Shiro 1.8.0-shiro-1.8.2 and 1.13.0-shiro-1.13.2

Vulnerability Info

This High-severity vulnerability is found in the shiro-core package in all versions of Apache Shiro through 2.2.0, as well as the 3.0.0-alpha-1 pre-release. DefaultLdapRealm (named JndiLdapRealm before Shiro 1.4.0) is Shiro's default LDAP realm. When a userDnTemplate such as uid={0},ou=users,dc=mycompany,dc=com is configured, every authentication attempt substitutes the submitted username into the {0} placeholder by plain string concatenation in getUserDn:

StringBuilder sb = new StringBuilder(prefixLength + principal.length() + suffixLength);
if (prefixLength > 0) {
    sb.append(prefix);
}
sb.append(principal);  // untrusted username, no RFC 2253 escaping

The username is never escaped for RFC 2253 special characters, so a login name containing characters such as ,, =, +, <, >, #, ;, or backslash escape sequences changes the structure of the DN itself instead of being treated as a literal value. The realm then binds to the directory server with the attacker-shaped DN, so the application can end up authenticating the attacker against a different directory entry than the template intended, potentially bypassing authentication or impersonating another user (CWE-90). The attack requires no prior authentication or user interaction; any login form that feeds a DefaultLdapRealm (or its predecessor JndiLdapRealm) configured with a userDnTemplate is exposed. ActiveDirectoryRealm performs the same unescaped concatenation when it appends the configured principal suffix to a submitted username.

Mitigation

Apache Shiro 1.x is End-of-Life and no longer receives open-source updates to address this issue. The final 1.x release was 1.13.0; as of February 28, 2024, Shiro v1 was superseded by v2.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Shiro to a currently supported release line that contains the fix, first shipped upstream in Apache Shiro 2.2.1 (2.x line) and 3.0.0 (3.x line).
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• zhaokaifei from ChinaTelecom (finder)