{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-129349", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-11-14T05:29:36.745Z", "datePublished": "2026-11-15T09:31:50.485Z", "dateUpdated": "2026-11-15T10:09:36.382Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-15T09:31:50.485Z"}, "title": "Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled", "problemTypes": [{"descriptions": [{"description": "CWE-287 Improper Authentication", "lang": "en", "cweId": "CWE-287", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Shiro", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.shiro:shiro-core", "packageURL": "pkg:maven/org.apache.shiro/shiro-core", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password.\nA cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher\u00a0installed by default in DefaultLdapRealm\u00a0accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user.\nThis issue affects all Apache Shiro versions through 3.0.0, only when using DefaultLdapRealm\u00a0(or JndiLdapRealm) with authenticationCachingEnabled\u00a0set to\u00a0true, which is not the default.\n\nMitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing AllowAllCredentialsMatcher\u00a0by default.\nAlternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies credentials against the cached authentication info.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "When authentication caching is enabled on <code>DefaultLdapRealm</code>, after a user logs in successfully once, subsequent logins for that user succeed with any password.<br>A cached authentication skips the LDAP bind, and the <code>AllowAllCredentialsMatcher</code>&nbsp;installed by default in <code>DefaultLdapRealm</code>&nbsp;accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user.<br>This issue affects all Apache Shiro versions through 3.0.0, only when using <code>DefaultLdapRealm</code>&nbsp;(or <code>JndiLdapRealm</code>) with <code>authenticationCachingEnabled</code>&nbsp;set to&nbsp;<code>true</code>, which is not the default.<br><br>Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing <code>AllowAllCredentialsMatcher</code>&nbsp;by default.<br>Alternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as <code>SimpleCredentialsMatcher</code>, that verifies credentials against the cached authentication info."}]}], "references": [{"url": "https://lists.apache.org/thread.html/1whn52ht402lhc782c3s843c9hho8b4y", "tags": ["vendor-advisory"]}], "metrics": [{"scenarios": [{"lang": "en", "value": "GENERAL"}], "format": "CVSS", "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NEGLIGIBLE", "Automatable": "YES", "Recovery": "USER", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "LOW", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:L/U:Red"}}], "credits": [{"lang": "en", "value": "Joshua Rogers", "type": "finder"}, {"lang": "en", "value": "Lenny Primak <lenny@flowlogix.com>", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/14/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-15T10:09:36.382Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.shiro:shiro-core", "packageURL": "pkg:maven/org.apache.shiro/shiro-core", "product": "Apache Shiro", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins for that user succeed with any password.\nA cached authentication skips the LDAP bind, and the AllowAllCredentialsMatcher\u00a0installed by default in DefaultLdapRealm\u00a0accepts any credentials, allowing an attacker who knows a valid username to authenticate as that user.\nThis issue affects all Apache Shiro versions through 3.0.0, only when using DefaultLdapRealm\u00a0(or JndiLdapRealm) with authenticationCachingEnabled\u00a0set to\u00a0true, which is not the default.\n\nMitigation: Upgrade to version 3.0.1 or later, which fixes the issue by no longer installing AllowAllCredentialsMatcher\u00a0by default.\nAlternatively, disable authentication caching on the LDAP realm (this is the default), or configure a credentials matcher, such as SimpleCredentialsMatcher, that verifies credentials against the cached authentication info."}], "id": "CVE-2026-129349", "lastModified": "2026-11-15T10:16:53.020", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "source": "security@apache.org", "type": "Secondary"}]}, "published": "2026-11-15T10:16:53.020", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/1whn52ht402lhc782c3s843c9hho8b4y"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/14/8"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{}