CVE-2026-56091

Overview

Apache Shiro is an open-source Java security framework that performs authentication, authorization, cryptography, and session management for applications ranging from small mobile apps to large web and enterprise systems. Its shiro-guice module integrates Shiro with the Google Guice dependency-injection framework, wiring Shiro's servlet filter chains through Guice so that path-based authentication and authorization rules are enforced in front of the application.

An authorization bypass vulnerability (CVE-2026-56091) has been identified in the Apache Shiro shiro-guice module, which allows attackers to bypass the authentication and authorization filters protecting a resource by appending a trailing slash to its URL path.

Per CWE-289: the product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

This issue affects all versions of Apache Shiro through 2.x, as well as the 3.0.0-alpha-1 pre-release, when the shiro-guice module is used in a web servlet context.

Details

Module Info

• Product: Apache Shiro
• Affected packages: org.apache.shiro:shiro-guice
• Affected versions: <3.0.0
• GitHub repository: https://github.com/apache/shiro
• Published packages: https://central.sonatype.com/artifact/org.apache.shiro/shiro-guice
• Package manager: Maven
• Fixed in: NES for Apache Shiro 1.8.0-shiro-1.8.2 and 1.13.0-shiro-1.13.2

Vulnerability Info

This High-severity vulnerability is found in the org.apache.shiro:shiro-guice package in all versions of Apache Shiro through 2.x, as well as the 3.0.0-alpha-1 pre-release. Applications that configure Shiro through the Guice web integration (ShiroWebModule) resolve their servlet filter chains with the module's own SimpleFilterChainResolver. Its getChain() method matches the raw request path against each configured chain pattern without normalizing a trailing slash:

String path = WebUtils.getPathWithinApplication(WebUtils.toHttp(request));
for (final String pathPattern : chains.keySet()) {
    if (patternMatcher.matches(pathPattern, path)) {
        // builds and returns the Shiro filter chain for this pattern
    }
}
return null;

The default pattern matcher is Shiro's AntPathMatcher, and a pattern that does not end in a slash never matches a path that does. A request for /admin/foo/ therefore fails to match a chain configured for /admin/foo, getChain() returns null, and the Shiro filter chain is skipped entirely: the request continues down the original servlet chain with no authentication or authorization filters applied. When the servlet container routes the trailing-slash variant to the same protected resource, an unauthenticated attacker reaches it by simply appending a slash to the URL.

Only the Guice integration is affected. The resolver used by INI-configured deployments, PathMatchingFilterChainResolver in the shiro-web module, already strips trailing slashes from both the request path and the chain patterns before matching; the Guice module's separate resolver never received the same normalization.

Mitigation

Apache Shiro 1.x is End-of-Life and no longer receives open-source updates to address this issue. The final 1.x release was 1.13.0; as of February 28, 2024, Shiro v1 was superseded by v2. No publicly available fix exists for the 1.x or 2.x lines; the fix for this issue shipped only in Apache Shiro 3.0.0.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Shiro to a currently supported release line that contains the fix, first shipped upstream in Apache Shiro 3.0.0.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• LocalHost (finder)