Apache Shiro allows an attacker to determine whether a username exists purely by measuring the response time of authentication requests. Because the processing path differs for valid and invalid accounts, a brute‑force attacker can incrementally identify all legitimate usernames. The vulnerability is a timing attack, mapped to CWE‑208, and can lead to credential guessing and social engineering when used with other known weaknesses.

The affected products are Apache Shiro, a security framework employed by many Java applications. Versions 1.* and any 2.* release prior to 2.0.7 are vulnerable. Apache Software Foundation product Shiro 1.0 through 2.0.6 lacks the patch that neutralizes the timing inconsistency.

The CVSS base score is 1, indicating a low severity assessment. EPSS indicates a very low exploitation probability (<1%). The vulnerability is not listed in CISA's KEV catalog. Exploitation requires local or network access to the Shiro authentication interface and relies on accurately timing responses, which is typically feasible in a sandboxed or moderately privileged environment. Attackers would need no additional privileges, but would benefit from privileged or local execution to capture precise timing, thus the risk level remains low but non‑negligible.