CVE-2026-43828

May 26, 2026, 7:05 p.m.

5.9
Medium

Description

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

Product(s) Impacted

Vendor Product Versions
Apache
  • Shiro
  • 1.0, 2.0, 2.1.0, 3.0.0-alpha-1, <2.1.1, 2.1.1, 3.0.0-alpha-2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-614
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a apache shiro 1.0 / / / / / / /
a apache shiro 2.0 / / / / / / /
a apache shiro 2.1.0 / / / / / / /
a apache shiro 3.0.0-alpha-1 / / / / / / /
a apache shiro <2.1.1 / / / / / / /
a apache shiro 2.1.1 / / / / / / /
a apache shiro 3.0.0-alpha-2 / / / / / / /

References

https://shiro.apache.org/security-reports.html#cve_2026_43828
http://www.openwall.com/lists/oss-security/2026/05/25/7

Tags

[email protected]
CWE-614
2026-05-25
CVE-2026-43828

CVSS Score

5.9 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: PRESENT
  • Privileges Required: NONE
  • User Interaction: ACTIVE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber

    View Vector String

Timeline

Published: May 25, 2026, 9:16 p.m.
Last Modified: May 26, 2026, 7:05 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.