CVE Tools
Sign in
Back to feed
Patch released Apache Shiro auth-bypass Apache Software Foundation network-edge

Critical Apache Shiro LDAP Injection Flaw Uncovered

Daily CyberSecurity (securityonline.info)·By Do Son··2 min read
CVE Tools coverage

Researchers identified a critical LDAP injection issue in Apache Shiro’s DefaultLdapRealm that could let attackers bypass authentication by manipulating the LDAP Distinguished Name (DN) construction. The vulnerability is tracked as CVE-2026-49268 and affects Apache Shiro versions below 2.2.1, as well as versions 3.0.0-alpha-0 through 3.0.0-alpha-1, with a high CVSS score of 8.8. Organizations should remediate by updating to Apache Shiro 2.2.1 or later (or 3.0.0-alpha-2 and later) to prevent impersonation and unauthorized access.

Open on Daily CyberSecurity (securityonline.info)

Related coverage

Other stories on the same CVEs
No other coverage for these CVEs yet.
Worried this affects your company?

See what your business actually exposes to the Internet — a free external review, no install, no obligation.

Check my exposure