Observable Timing Discrepancy in Apache Shiro by Apache Software Foundation

CVE-2026-23901

What is CVE-2026-23901?

The vulnerability in Apache Shiro allows attackers to exploit timing discrepancies between requests for existing and non-existent users. Attackers can leverage this information to conduct brute-force attacks more effectively. This issue is primarily a local attack risk, as it enables the determination of whether a username is valid based solely on the timing of responses. Users are advised to upgrade to version 2.0.7 or later to mitigate this vulnerability and strengthen their security.

References