CVE Explorer
CVE-2026-23901
Observable Timing Discrepancy vulnerability in Apache Shiro.
This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.
Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.
Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough,
that a brute-force attack may be able to tell, by timing the requests only, determine if
the request failed because of a non-existent user vs. wrong password.
The most likely attack vector is a local
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.shiro:shiro-core","product":"Apache Shiro","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.0.7","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:640030e5f11f67b89ccf76e168b5d7569244866b1fdb27a0b6e5a7e9476de112 · sha256:f167db56be9cb834… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"YES","Recovery":"AUTOMATIC","Safety":"NEGLIGIBLE","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":1,"baseSeverity":"LOW","privilegesRequired":"LOW","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/R:A/V:C/RE:L/U:Green","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrity…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:640030e5f11f67b89ccf76e168b5d7569244866b1fdb27a0b6e5a7e9476de112 · sha256:f167db56be9cb834… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-208","description":"CWE-208 Observable Timing Discrepancy","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:640030e5f11f67b89ccf76e168b5d7569244866b1fdb27a0b6e5a7e9476de112 · sha256:f167db56be9cb834… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"url":"http://www.openwall.com/lists/oss-security/2026/02/08/2"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:640030e5f11f67b89ccf76e168b5d7569244866b1fdb27a0b6e5a7e9476de112 · sha256:f167db56be9cb834… · /containers/adp/0/references/0
{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/mm1jct9b86jvnh3y44tj22xvjtx3xhhh"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:640030e5f11f67b89ccf76e168b5d7569244866b1fdb27a0b6e5a7e9476de112 · sha256:f167db56be9cb834… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.