CVE-2026-49268CWE-90

Apache Shiro: LDAP DN Injection in DefaultLdapRealm

High · published June 17, 2026

CVSS v4.0
8.8
EPSS
1%
Percentile
54.6
In the wild
Unconfirmed
What it is

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonating other users.

This issue affects all Apache Shiro versions through 2.2.0, and 3.0.0-alpha-1 when using DefaultLdapRealm

Upgrade to Apache Shiro 2.2.1 or 3.0.0-alpha-2 or later, which fixes the issue.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/R:A/RE:L/U:Red
EPSS
0.00755 · 54.6th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2026-06-17T13:07Z
EPSS history
Timeline
  • 17 JUN 13:07Z
    Apache Shiro: LDAP DN Injection in DefaultLdapRealm
    cvelistv5