The vulnerability is an Authentication Bypass by Alternate Name in Apache Shiro. It affects all releases prior to 2.0.7. The issue is limited to static files served from a case‑insensitive filesystem, such as the default macOS setup. An attacker can change the case of the filename in the HTTP request to bypass authentication filters that only detect lower‑case names, allowing unauthorized access to protected static resources. This exploit does not compromise the entire application but can expose potentially sensitive data.

All releases of Apache Shiro prior to 2.0.7 are affected. The issue is addressed in 2.0.7, which introduces a new parameter in shiro.ini or application.properties that enables case‑insensitive filter resolution when true. Future versions 3.0.0 and later make this behaviour the default.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely via HTTP requests by altering the case of a static file name; no special privileges or local access are required. Given the moderate score but low likelihood of exploitation, the overall risk remains moderate, but patching is recommended to eliminate the possibility of unauthorized static content exposure.