Apache Shiro has an Authentication Bypass

Impact

Authentication Bypass: A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).

The issue arises when Shiro's URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting /SECRET.TXT to bypass a rule for /secret.txt).

This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.

Patches

Users should upgrade to Apache Shiro 2.1.0 or later.

Important Configuration Note: Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:

• shiro.ini:
  ini

  filterChainResolver.caseInsensitive = true

• Spring Boot (application.properties):
  properties

  shiro.caseInsensitive=true

Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.

Workarounds

• Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix).
• Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).

Resources

• CVE-2026-23903
• Mailing List Announcement
• OSS-Security List