Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*,
    2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior
    to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force
    attack may be able to tell, by timing the requests only, determine if the request failed because of a non-
    existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security
    model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically,
    brute force attack can be mitigated at the infrastructure level. (CVE-2026-23901)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*,     2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior     to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force     attack may be able to tell, by timing the requests only, determine if the request failed because of a non-     existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security     model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically,     brute force attack can be mitigated at the infrastructure level. (CVE-2026-23901)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
437682	SCA: security update for org.apache.shiro:shiro-core (GHSA-c4qc-4q9p-m9q9)	Tenable Cloud Security	SCA Checks	low
437682	SCA: security update for org.apache.shiro:shiro-core (GHSA-c4qc-4q9p-m9q9)	Tenable Self-Hosted Container Security	SCA Checks	low
298459	Linux Distros Unpatched Vulnerability : CVE-2026-23901	Nessus	Misc.	low

Detections

Analytics

CVE-2026-23901

low

Tenable Plugins

low

low

low