Observable Timing Discrepancy in Apache Shiro by Apache Software Foundation

CVE-2026-23901

What is CVE-2026-23901?

The vulnerability in Apache Shiro allows attackers to exploit timing discrepancies between requests for existing and non-existent users. Attackers can leverage this information to conduct brute-force attacks more effectively. This issue is primarily a local attack risk, as it enables the determination of whether a username is valid based solely on the timing of responses. Users are advised to upgrade to version 2.0.7 or later to mitigate this vulnerability and strengthen their security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References