CVE-2026-23901
📋 TL;DR
This CVE describes an observable timing discrepancy vulnerability in Apache Shiro authentication. Attackers can use timing differences to distinguish between non-existent users and incorrect passwords, enabling user enumeration. This affects Apache Shiro versions 1.* and 2.* before 2.0.7.
💻 Affected Systems
- Apache Shiro
📦 What is this software?
Shiro by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could enumerate valid usernames, then perform targeted password brute-force attacks against known accounts.
Likely Case
Local attackers could identify valid user accounts, increasing efficiency of credential stuffing attacks.
If Mitigated
With proper network controls and rate limiting, impact is limited to potential user enumeration without credential compromise.
🎯 Exploit Status
Attack requires timing measurements but no special tools beyond standard HTTP clients.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.7 or later
Vendor Advisory: https://lists.apache.org/thread/mm1jct9b86jvnh3y44tj22xvjtx3xhhh
Restart Required: Yes
Instructions:
1. Download Apache Shiro 2.0.7 or later. 2. Replace existing Shiro JAR files. 3. Restart application server. 4. Verify authentication still works correctly.
🔧 Temporary Workarounds
Implement rate limiting
allAdd request rate limiting at application or infrastructure level to prevent timing-based enumeration
Add random delays
allImplement uniform response times for all authentication attempts regardless of outcome
🧯 If You Can't Patch
- Implement network-level rate limiting and monitoring for authentication attempts
- Deploy WAF rules to detect and block timing-based enumeration patterns
🔍 How to Verify
Check if Vulnerable:
Check Shiro version in application dependencies or classpath. Vulnerable if version is 1.* or 2.* < 2.0.7.Check Version:
Check Maven/Gradle dependencies or examine shiro-core-*.jar file versionVerify Fix Applied:
Verify Shiro version is 2.0.7 or later and test authentication with timing measurements shows consistent response times.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts with varying response times
- Patterns of authentication attempts against non-existent users
Network Indicators:
- Unusual volume of authentication requests from single source
- Requests with incremental timing measurements
SIEM Query:
source="auth.log" ("authentication failed" OR "login failed") | stats count by src_ip, user | where count > threshold