External risk intelligence

Apache Shiro Authentication Bypass via Cached Credentials.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-129349

Apache Shiro is a security framework commonly integrated into web applications, APIs, and enterprise services to handle authentication and authorization. Because these components often sit at the edge of or within internet-facing services, they are frequently exposed to network traffic. While the specific vulnerable configuration is non-default, the framework's primary role in managing access makes public exposure a common deployment pattern.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability exists in the Apache Shiro authentication caching mechanism when enabled in specific LDAP configurations. This flaw allows an attacker to bypass password checks after a legitimate user has logged in once, potentially granting unauthorized access. While not the default setting, organizations using this configuration should review their exposure.

Authentication bypass possible with specific Shiro settings.
Important for systems managing user access.
Confirm if this Shiro feature is enabled.

Attack Path

How an attacker could exploit the issue

An attacker who knows a valid username can bypass authentication. This occurs when an application uses Apache Shiro with authentication caching enabled on its LDAP realm, a non-default configuration. Once a user successfully logs in once, subsequent login attempts with any password will succeed because the cached authentication skips the LDAP bind and allows any credentials. This could allow unauthorized access to the application.

Attacker needs valid username.
Subsequent logins with any password.
Unauthorized access to the application.

Live Threat

Current exploitation, exposure, and threat context

When authentication caching is enabled on specific Apache Shiro LDAP realms, successful authentication with any password can occur after an initial legitimate login for a user, bypassing credential checks. This could affect system access when authentication caching is active and a user's credentials have been previously cached.

User account access.
Bypassed credential validation.
Unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache Shiro's authentication caching could allow unauthorized access by bypassing password checks. Platform or application teams responsible for Shiro implementations need to investigate where this framework is deployed, especially if authentication caching is enabled, and confirm its business criticality and reachability. The first practical step is to identify all instances, assess their exposure, and then plan remediation based on the risk.

Platform or application owners should own.
Verify authentication caching is enabled.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Shiro?

Apache Shiro is a comprehensive Java security framework used to manage application security tasks, including authentication, authorization, and session management. Developers embed it into web applications and enterprise services to handle how users log in and what resources they can access. Because it acts as the gatekeeper for these systems, it is a foundational component for securing user identities across various software environments.

What is the vulnerability in CVE-2026-129349?

This CVE describes an authentication bypass weakness, categorized as CWE-287. In affected versions of Apache Shiro, when authentication caching is specifically enabled for LDAP realms, the system incorrectly trusts cached data. After a legitimate user logs in once, the framework fails to perform a full credential verification for subsequent attempts, effectively allowing any password to grant access to that user account.

How can an attacker trigger this bypass?

An attacker needs to know a valid username for the target system. The flaw is only triggered if authentication caching is explicitly enabled for the LDAP realm, which is not the default configuration. If caching is disabled or not used, the vulnerability does not manifest. The bypass requires that the specific user has already authenticated successfully at least once, populating the cache with the vulnerable state.

Why should I care about this if my app is internal?

According to Halo Surface Signal, Apache Shiro is a security framework commonly integrated into web applications, APIs, and enterprise services. Because these services often reside at the edge of networks to manage access, they are frequently exposed to network traffic. Even for internal applications, this vulnerability allows unauthorized access once a user is known, potentially expanding the impact of a compromised account within your network perimeter.

How do I secure my systems against this?

The most effective first step is to identify all applications using Apache Shiro and verify if authentication caching is enabled on any LDAP realms. If you find this configuration, you should either disable authentication caching, which is the default, or upgrade to Apache Shiro version 3.0.1 or later. The update removes the insecure default credentials matcher, ensuring that cached logins still properly validate passwords.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.