CVE-2021-41303

CRITICAL9.8EPSS 49.3%

Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass

Published: 9/20/2021Modified: 4/28/2026

Description

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (6)