CVE-2020-13933

CVE-2020-13933 Lab Shiro 1.6.0 Authentication Bypass Vulnerability PoC http://127.0.0.1:8080/res/%3bpoc Lab Environment Code Description ShiroConfig.java: Permission configuration: when requesting /res/ resources, it returns a 302 redirect to the login page for authentication. NameController.java...

Authentication Bypass by Alternate Name

Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name in the shiro-guice module when...

ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2), ca.ibodrov.concord:testcontainers-concord-core (>=2.0.3, <=2.0.5) +264 more potentially affected by CVE-2026-56091 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1, <=3.0.0-alpha-1)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =0.0.1, =2.0.3, =0.0.27, =0.0.27, =0.0.27, =8.0.0, =8.0.0, =4.0.0, =1.0.2, =3.4.0, =3.3.0, =3.3.0, =3.3.0, =3.9.1 and more Source cves: CVE-2026-56091 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17756771...

Replay Attack

Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the...

br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1), ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2) +1659 more potentially affected by CVE-2026-56130 via org.apache.shiro:shiro-web (>=1.2.4, <=3.0.0-alpha-1)

org.apache.shiro:shiro-web MAVEN version =1.2.4, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.0, =1.0.0, =2.0.0 and more Source cves: CVE-2026-56130 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17756767...

br.com.caelum.vraptor:vraptor-shiro (>=4.0.0-beta-1, <=4.0.0-rc2), br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1) +1871 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-web (>=1.0.0-incubating, <=2.1.0)

org.apache.shiro:shiro-web MAVEN version =1.0.0-incubating, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.0, =1.0.5 - cloud.opencode.base:opencode-base-token 1.0.0 and more Source cves: CVE-2026-43828 Source advisory: OSV:GHSA-C6R4-QJMW-CVJ...

br.com.caelum.vraptor:vraptor-shiro (>=4.0.0-beta-1, <=4.0.0-rc2), br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1) +1871 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-web (>=1.0.0-incubating, <=2.1.0)

org.apache.shiro:shiro-web MAVEN version =1.0.0-incubating, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.0, =1.0.5 - cloud.opencode.base:opencode-base-token 1.0.0 and more Source cves: CVE-2026-43828 Source advisory: GHSA-C6R4-QJMW-CVJ2...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +14 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-web (3.0.0-alpha-1)

org.apache.shiro:shiro-web MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-web and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

Session Fixation

Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Session Fixation during the login operation in DefaultSecurityManager.ja...

ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2), ca.ibodrov.concord:testcontainers-concord-core (>=2.0.3, <=2.0.5) +195 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1, <=2.1.0)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =0.0.1, =2.0.3, =0.0.27, =0.0.27, =0.0.27, =8.0.0, =8.0.0, =1.0.2, =3.4.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.8.0 and more Source cves: CVE-2026-43827 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17116506...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute in the form...

ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2), ca.ibodrov.concord:testcontainers-concord-core (>=2.0.3, <=2.0.5) +195 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1, <=2.1.0)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =0.0.1, =2.0.3, =0.0.27, =0.0.27, =0.0.27, =8.0.0, =8.0.0, =1.0.2, =3.4.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.8.0 and more Source cves: CVE-2026-43828 Source advisory: SNYK:JAVA-ORGAPACHESHIRO-17116502...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +14 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-web (3.0.0-alpha-1)

org.apache.shiro:shiro-web MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-web and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +14 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-web (3.0.0-alpha-1)

org.apache.shiro:shiro-web MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-web and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

br.com.caelum.vraptor:vraptor-shiro (>=4.0.0-beta-1, <=4.0.0-rc2), br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1) +1871 more potentially affected by CVE-2026-43828 via org.apache.shiro:shiro-web (>=1.0.0-incubating, <=2.1.0)

org.apache.shiro:shiro-web MAVEN version =1.0.0-incubating, =4.0.0-beta-1, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.0.21, =0.0.27, =0.0.2, =0.0.27, =0.0.1, =1.0.2, =1.0.0, =1.0.5 - cloud.opencode.base:opencode-base-token 1.0.0 and more Source cves: CVE-2026-43828 Source advisory: MEND:CVE-2026-43828...

com.nb6868.onex:common (5.0.3), com.nb6868.onex:file-converter (5.0.3) +14 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-web (3.0.0-alpha-1)

org.apache.shiro:shiro-web MAVEN version 3.0.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-web and may be impacted: - com.nb6868.onex:common 5.0.3 - com.nb6868.onex:file-converter 5.0.3 - com.nb6868.onex:job 5.0.3 -...

ca.ibodrov.concord:mcp-for-concord (>=0.0.1, <=0.0.2), ca.ibodrov.concord:testcontainers-concord-core (>=2.0.3, <=2.0.5) +189 more potentially affected by CVE-2026-43827 via org.apache.shiro:shiro-web (>=2.0.0, <=2.1.0)

org.apache.shiro:shiro-web MAVEN version =2.0.0, =0.0.1, =2.0.3, =0.0.27, =0.0.27, =0.0.27, =8.0.0, =8.0.0, =1.0.2, =3.4.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.8.0 and more Source cves: CVE-2026-43827 Source advisory: MEND:CVE-2026-43827...

cloud.opencode.base:opencode-base-token (1.0.0), io.github.junxworks:junx-ep-auth (>=2.0.0, <=2.1.0) +11 more potentially affected by CVE-2023-46750 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1, <=2.0.0-alpha-3)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-3 Source cves: CVE-2023-46750 Source advisory: OSV:GHSA-HHW5-C326-822H...

cloud.opencode.base:opencode-base-token (1.0.0), io.github.junxworks:junx-ep-auth (>=2.0.0, <=2.1.0) +11 more potentially affected by CVE-2023-46750 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1, <=2.0.0-alpha-3)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-3 Source cves: CVE-2023-46750 Source advisory: GHSA-HHW5-C326-822H...

br.com.caelum.vraptor:vraptor-shiro (>=4.0.0-beta-1, <=4.0.0-rc2), br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1) +1665 more potentially affected by CVE-2023-46750 via org.apache.shiro:shiro-web (>=1.0.0-incubating, <=1.12.0)

org.apache.shiro:shiro-web MAVEN version =1.0.0-incubating, =4.0.0-beta-1, =1.0.0, =0.0.2, =0.0.21, =0.0.2, =0.0.1, =1.0.2, =1.0.0, =1.0.0, =5.2.1, =1.0.0, =0.1, =0.1, =0.2 and more Source cves: CVE-2023-46750 Source advisory: GHSA-HHW5-C326-822H...