When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context. Upgrade to version 3.0.0 or later, which fixes the issue.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP
    request may cause an authentication bypass. This vulnerability is similar to
    https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the
    `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions
    through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context. Upgrade to
    version 3.0.0 or later, which fixes the issue. (CVE-2026-56091)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP     request may cause an authentication bypass. This vulnerability is similar to     https://www.cve.org/CVERecord?id=CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the     `shiro-guice` module instead of the `shiro-spring` module. This issue affects all Apache Shiro versions     through 2.x, and 3.0.0-alpha-1 only when using `shiro-guice` module in a web servlet context. Upgrade to     version 3.0.0 or later, which fixes the issue. (CVE-2026-56091)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478305	SCA: security update for org.apache.shiro:shiro-guice (GHSA-qj64-jj84-w38j)	Tenable Cloud Security	SCA Checks	Local	high
478305	SCA: security update for org.apache.shiro:shiro-guice (GHSA-qj64-jj84-w38j)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
323342	Linux Distros Unpatched Vulnerability : CVE-2026-56091	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-56091

high

Tenable Plugins

Coming Soon

high

high

high