CVE-2026-129349: 
Linux Debian Analyse et atténuation de la vulnérabilité

CVE-2026-129349 is an authentication bypass vulnerability in Apache Shiro where the DefaultLdapRealm component accepts any password when authentication caching is enabled. This flaw allows unauthenticated attackers to gain unauthorized access to applications protected by Apache Shiro's LDAP-based authentication. The vulnerability was disclosed on November 14, 2026, with a patch released the same day (Apache Advisory). It is estimated to be HIGH severity based on CVSS category assessment (Feedly).

The root cause of this vulnerability lies in improper authentication logic within Apache Shiro's DefaultLdapRealm when authentication caching is enabled (CWE-287: Improper Authentication). When a cached authentication result exists, the realm fails to properly validate the supplied password against the LDAP directory, effectively accepting any password for a previously authenticated user. The attack vector is network-accessible and requires no prior authentication or special privileges — an attacker only needs to know a valid username to exploit the flaw (Apache Advisory, Feedly).

Successful exploitation allows an unauthenticated attacker to completely bypass authentication controls and gain unauthorized access to any application using Apache Shiro's DefaultLdapRealm with caching enabled. Depending on the application's privilege model, this could result in full compromise of application functionality, unauthorized access to sensitive data, and potential for lateral movement within the environment if the application has access to internal systems or data stores (Feedly).

As of the disclosure date, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Feedly). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the straightforward nature of the authentication bypass — requiring only a valid username and any arbitrary password — makes it relatively easy to exploit once the precondition (authentication caching enabled) is confirmed, increasing the risk of future weaponization.

1. Reconnaissance: Identify applications using Apache Shiro with LDAP authentication (e.g., via HTTP response headers such as JSESSIONID cookies, login page fingerprinting, or known application banners).
2. Enumerate valid usernames: Gather valid LDAP usernames through OSINT, directory enumeration, or application-level username disclosure (e.g., error message differences between valid and invalid usernames).
3. Trigger cache population: If needed, allow a legitimate user to authenticate first so their credentials are cached by DefaultLdapRealm, or attempt authentication with a known username to populate the cache.
4. Submit authentication bypass request: Send a login request with the valid username and any arbitrary password string to the application's authentication endpoint.
5. Gain unauthorized access: If authentication caching is enabled and the username exists in the cache, Shiro accepts the request and grants access as the targeted user, bypassing LDAP credential validation (Apache Advisory, Feedly).

• Logs: Application authentication logs showing successful logins for users with incorrect or unexpected passwords; repeated successful authentications from unusual source IPs or at unusual times.
• Network: Unusual login attempts from external or unexpected IP addresses targeting the application's authentication endpoint; successful sessions established without prior failed attempts (indicating no brute-force, just direct bypass).
• Application Behavior: Multiple successful sessions for the same user account from different geographic locations or devices simultaneously, suggesting credential-free access.
• LDAP Logs: Absence of corresponding LDAP bind/authentication requests in directory server logs for sessions that appear authenticated in the application layer (indicating cache-based bypass without LDAP validation).

Apply the patch released by Apache Shiro on November 14, 2026, by upgrading to the fixed version as soon as possible (Apache Advisory). As an interim workaround, disable authentication caching in the DefaultLdapRealm configuration until the patch can be applied — this eliminates the precondition required for exploitation (Feedly). Organizations should also review Shiro configuration files to confirm whether caching is enabled and audit recent authentication logs for signs of unauthorized access.

The vulnerability was discussed on the OSS-Security mailing list shortly after disclosure (OSS-Sec). Social media activity was observed on Bluesky and X (formerly Twitter), with the International Cyber Digest account sharing the advisory (X/IntCyberDigest). Security news outlet Brandefense covered the advisory as part of Apache Shiro's November 2026 security updates (Brandefense). Community reaction has been moderate, with no major controversy or widespread alarm given the absence of public exploits at time of disclosure.