CVE-2026-23901 - Low Severity Vulnerability
Vulnerable Library - shiro-core-2.0.6.jar
Library home page: https://shiro.apache.org/
Path to dependency file: /framework/build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.shiro/shiro-core/2.0.6/cd7aaf8c3caf0b62d9cacd87aa8461eac18ed58f/shiro-core-2.0.6.jar
Dependency Hierarchy:
- ❌ shiro-core-2.0.6.jar (Vulnerable Library)
Found in HEAD commit: 564ec93ea5f77b4a431795e547276f91231f0859
Found in base branch: master
Vulnerability Details
Observable Timing Discrepancy vulnerability in Apache Shiro.
This issue affects Apache Shiro: from 1., 2. before 2.0.7.
Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.
Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough,
that a brute-force attack may be able to tell, by timing the requests only, determine if
the request failed because of a non-existent user vs. wrong password.
The most likely attack vector is a local attack only.
Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well.
Typically, brute force attack can be mitigated at the infrastructure level.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-02-10
URL: CVE-2026-23901
CVSS 3 Score Details (2.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://seclists.org/oss-sec/2026/q1/149
Release Date: 2026-02-07
Fix Resolution: 2.1.0
Step up your Open Source Security Game with Mend here
CVE-2026-23901 - Low Severity Vulnerability
Library home page: https://shiro.apache.org/
Path to dependency file: /framework/build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.shiro/shiro-core/2.0.6/cd7aaf8c3caf0b62d9cacd87aa8461eac18ed58f/shiro-core-2.0.6.jar
Dependency Hierarchy:
Found in HEAD commit: 564ec93ea5f77b4a431795e547276f91231f0859
Found in base branch: master
Observable Timing Discrepancy vulnerability in Apache Shiro.
This issue affects Apache Shiro: from 1., 2. before 2.0.7.
Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.
Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough,
that a brute-force attack may be able to tell, by timing the requests only, determine if
the request failed because of a non-existent user vs. wrong password.
The most likely attack vector is a local attack only.
Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well.
Typically, brute force attack can be mitigated at the infrastructure level.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-02-10
URL: CVE-2026-23901
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://seclists.org/oss-sec/2026/q1/149
Release Date: 2026-02-07
Fix Resolution: 2.1.0
Step up your Open Source Security Game with Mend here