1005 matches found
Authentication Bypass by Alternate Name
Overview Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name in the shiro-guice module when deployed in a web servlet context. An attacker can gain unauthorized access by sending specially crafted HTTP requests. Remediation Upgrade...
br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1), ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2) +2060 more potentially affected by CVE-2026-56130 via org.apache.shiro:shiro-lang (>=1.4.0-rc2, <=3.0.0-alpha-1)
org.apache.shiro:shiro-lang MAVEN version =1.4.0-rc2, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.2, =1.0.5 - cloud.opencode.base:opencode-base-token 1.0.0 and more Source cves: CVE-2026-56130 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17756769...
Replay Attack
Overview Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the RememberMe cookie. An attacker can maintain unauthorized access by intercepting and reusing a valid cookie beyond its intended expiration. This is only exploitable if t...
Replay Attack
Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the...
br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1), ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2) +2707 more potentially affected by CVE-2026-56130 via org.apache.shiro:shiro-core (>=1.2.4, <=3.0.0-alpha-1)
org.apache.shiro:shiro-core MAVEN version =1.2.4, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.0, =1.0.5 - cloud.opencode.base:opencode-base-token 1.0.0 and more Source cves: CVE-2026-56130 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17756768...
br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1), ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2) +1659 more potentially affected by CVE-2026-56130 via org.apache.shiro:shiro-web (>=1.2.4, <=3.0.0-alpha-1)
org.apache.shiro:shiro-web MAVEN version =1.2.4, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.0, =1.0.0, =2.0.0 and more Source cves: CVE-2026-56130 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17756767...
Replay Attack
Overview org.apache.shiro:shiro-core is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the...
DEBIAN-CVE-2026-56130
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only whe...
CVE-2026-56130
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only whe...
DEBIAN-CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
UBUNTU-CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
UBUNTU-CVE-2026-56130
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only whe...
CVE-2026-56130
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only whe...
CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
CVE-2026-56091 Apache Shiro: Authentication bypass in Guice-Web integration
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
CVE-2026-56091 Apache Shiro: Authentication bypass in Guice-Web integration
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
EUVD-2026-39230
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...
CVE-2026-56091
When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the "shiro-guice" module...