Shiro and APISIX auth flaws, Dropbear socket bypass claim

Apache Shiro and Apache APISIX disclosed several authentication and authorization flaws, and an oss-security report claims Dropbear unix-socket forwarding can evade configured restrictions. LDAP-backed Shiro realms and APISIX gateways are the deployments most directly affected.

Apache Shiro LDAP realm accepts any cached password

Apache Shiro's DefaultLdapRealm accepts any password when authentication caching is enabled, tracked as CVE-2026-129349. The issue is described as critical and is fixed in Shiro 3.0.1. Deployments that cache LDAP authentication results should treat this as an authentication bypass until they upgrade.

Dropbear skips permitopen checks on unix sockets

An oss-security report says Dropbear does not enforce permitopen and permitlisten restrictions for unix-socket forwarding, so a restriction that names an address can still leave a socket such as docker.sock reachable. The claim is tied to HEAD 99baf182 and described as live-proven. Administrators who rely on those options to limit forwarding should not assume unix sockets are covered.

APISIX route auth bypass via path normalization

Apache APISIX CVE-2026-124680, scored CVSS 7.0, allows a route-level authentication bypass when path normalization differs between routing and upstream forwarding. Route plugins can therefore see a different path than the one used to select the route. Gateway operators should review path handling before the mismatch is used to skip authentication.

APISIX Keycloak plugin skips authorization scope

CVE-2026-124716 is a medium-severity authorization scope mismatch in the authz-keycloak plugin. It affects Apache APISIX 1.4.0 through 3.19.0 and is fixed in 3.20.0. Sites using that plugin for scope checks should upgrade rather than assume the configured scope is enforced.

APISIX plugins can forward a client identity header

CVE-2026-124679 covers an authentication bypass in the jwe-decrypt and forward-auth plugins, which may pass a client-supplied identity header. It affects Apache APISIX 3.18 and 3.19. Upstream services that trust that header can treat an unauthenticated client as an authenticated user.

Shiro RememberMe session fixation

CVE-2026-74762 describes possible session fixation when Apache Shiro RememberMe is in use. The issue is fixed in 3.0.1. Applications that keep sessions across remember-me logins should upgrade so a pre-set session identifier is not reused.

Shiro annotation checks depend on placement

CVE-2026-74763 says authorization annotations are not always enforced, depending on where they are placed, in the shiro-guice, aspectj, cdi, and jakarta-ee modules. The fix is in Apache Shiro 3.0.2. Code that relies on those annotations for access control may be unprotected until the modules are updated.

APISIX mTLS resources reachable without the expected client check

CVE-2026-124723 allows unauthorized access to mTLS-protected resources under a specific configuration. It affects Apache APISIX 3.18 and 3.19 and is fixed in 3.20. Operators who terminate mutual TLS in APISIX should confirm that configuration is not in use, or move to the fixed release.