Apache Shiro: Brute force attack possible to determine valid user names

Vulnerability

Overview

CVE-2026-23901 is an observable timing discrepancy vulnerability in Apache Shiro, a Java security framework. The issue affects all versions from 1.* and 2.* prior to 2.0.7. The root cause is that the authentication code paths for non-existent users versus existing users with wrong passwords differ enough in execution time that an attacker can distinguish between the two scenarios by measuring response times [1][2].\.

Exploitation

The attack vector is primarily local, meaning an attacker must be able to send authentication requests and measure their timing with sufficient precision. No special privileges are required authentication is needed to exploit the timing leak, as the discrepancy occurs during the initial login attempt. The vulnerability enables a brute-force attack to determine whether a given username exists on the system, which is a form of username enumeration [2\.

Impact

By exploiting the timing difference, an attacker can build a list of valid usernames. This information can then be used to focus password guessing attacks on known accounts, increasing the efficiency of brute-force or credential-stuffing attempts. While the severity is considered low, username enumeration can weaken other security controls [2\.

Mitigation

The fix is included in Apache Shiro version 2.0.7 and later. Users are strongly recommended to upgrade to the latest version. As a general mitigation, brute-force attacks can also be limited at the infrastructure level, for example by rate-limiting login attempts or using CAPTCHAs [1\.