CVE-2026-43828
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
- Record
CVE-2026-43828- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber - Weakness
- CWE-614
- Updated
- 2026-11-02
EUVDEUVD-2026-31734
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
- Record
EUVD-2026-31734- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c6r4-qjmw-cvj2
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
- Record
GHSA-c6r4-qjmw-cvj2- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/RE:L/U:Amber - Weakness
- CWE-614
- Updated
- 2026-11-02
NVD
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
- Record
CVE-2026-43828- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-614
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-43828
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
- Record
DEBIAN-CVE-2026-43828- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-c6r4-qjmw-cvj2
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
- Record
GHSA-c6r4-qjmw-cvj2- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/RE:L/U:Amber - Weakness
- CWE-614
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-43828
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
- Record
UBUNTU-CVE-2026-43828- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.shiro:shiro-webMaven |
1.0.0-incubating up to 2.2.0 | 2.2.0 |
org.apache.shiro:shiro-webMaven |
3.0.0-alpha-1 to 3.0.0-alpha-1 | 3.0.0-alpha-2 |
shiroDebian:12 |
All versions, plus listed versions 1.3.2-51.3.2-6 |
None known |
shiroDebian:13 |
All versions, plus listed versions 1.3.2-6 |
None known |
shiroDebian:14 |
All versions, plus listed versions 1.3.2-6 |
None known |
org.apache.shiro:shiro-webMaven |
1.0.0-incubating up to 2.2.0, plus listed versions 1.1.01.10.01.10.11.11.01.12.0 Show 37 moreShow less1.13.01.2.01.2.11.2.21.2.31.2.41.2.51.2.61.3.01.3.11.3.21.4.01.4.0-RC21.4.11.4.21.5.01.5.11.5.21.5.31.6.01.7.01.7.11.8.01.9.01.9.12.0.02.0.0-alpha-12.0.0-alpha-22.0.0-alpha-32.0.0-alpha-42.0.12.0.22.0.32.0.42.0.52.0.62.1.0 |
2.2.0 |
org.apache.shiro:shiro-webMaven |
3.0.0-alpha-1 up to 3.0.0-alpha-2 | 3.0.0-alpha-2 |
shiroUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2 |
None known |
shiroUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.2-21.3.2-3~18.041.3.2-3~18.04.11.3.2-3ubuntu0.18.04.1~esm1 |
None known |
shiroUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-4ubuntu0.11.3.2-4ubuntu0.2 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
shiroUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-5 |
None known |
shiroUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.3.2-51.3.2-5ubuntu0.24.04.1~esm1 |
None known |
shiroUbuntu:25.10 |
All versions, plus listed versions 1.3.2-6ubuntu1 |
None known |
shiroUbuntu:26.10 |
All versions, plus listed versions 1.3.2-6ubuntu2 |
None known |
shiroUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.2-6ubuntu11.3.2-6ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-43828 is a medium vulnerability (CVSS 5.9) in Apache Shiro, published May 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in org.apache.shiro:shiro-web 2.2.0.
References
shiro.apache.org/security-reports.html
openwall.com/lists/oss-security/2026/05/25/7
nvd.nist.gov/vuln/detail/CVE-2026-43828
github.com/advisories/GHSA-c6r4-qjmw-cvj2
security-tracker.debian.org/tracker/CVE-2026-43828
ubuntu.com/security/CVE-2026-43828
cve.org/CVERecord?id=CVE-2026-43828