CVE-2026-56130
Apache Shiro: Remember-me cookie isn't checked for expiry on the server
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.
Upgrade to version 3.0.0 or later, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Shiro: Remember-me cookie isn't checked for expiry on the server
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
CVE-2026-56130- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/V:D/RE:L/U:Green - Weakness
- CWE-294
- Updated
- 2026-11-02
EUVDEUVD-2026-39229
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
EUVD-2026-39229- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/V:D/RE:L/U:Green - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m8g6-vrr2-x7ff
Apache Shiro's "remember me" cookie age is not verified on the server.
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
GHSA-m8g6-vrr2-x7ff- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/V:D/RE:L/U:Green - Weakness
- CWE-294
- Updated
- 2026-11-03
NVD
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
CVE-2026-56130- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:D/RE:L/U:Green - Weakness
- CWE-294
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-56130
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled. Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
DEBIAN-CVE-2026-56130- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:D/RE:L/U:Green - Updated
- 2026-11-02
OSVGHSA-m8g6-vrr2-x7ff
Apache Shiro's "remember me" cookie age is not verified on the server.
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.
Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
GHSA-m8g6-vrr2-x7ff- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/V:D/RE:L/U:Green - Weakness
- CWE-294
- Updated
- 2026-11-03
OSVUBUNTU-CVE-2026-56130
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled. Upgrade to version 3.0.0 or later, which fixes the issue.
- Record
UBUNTU-CVE-2026-56130- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/V:D/RE:L/U:Green - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.shiro:shiro-coreMaven |
1.2.4 up to 3.0.0 | 3.0.0 |
org.apache.shiro:shiro-webMaven |
1.2.4 up to 3.0.0 | 3.0.0 |
shiroDebian:12 |
All versions, plus listed versions 1.3.2-51.3.2-6 |
None known |
shiroDebian:13 |
All versions, plus listed versions 1.3.2-6 |
None known |
shiroDebian:14 |
All versions, plus listed versions 1.3.2-6 |
None known |
org.apache.shiro:shiro-coreMaven |
1.2.4 up to 3.0.0, plus listed versions 1.10.01.10.11.11.01.12.01.13.0 Show 34 moreShow less1.2.51.2.61.3.01.3.11.3.21.4.01.4.0-RC21.4.11.4.21.5.01.5.11.5.21.5.31.6.01.7.01.7.11.8.01.9.01.9.12.0.02.0.0-alpha-12.0.0-alpha-22.0.0-alpha-32.0.0-alpha-42.0.12.0.22.0.32.0.42.0.52.0.62.1.02.2.02.2.13.0.0-alpha-1 |
3.0.0 |
org.apache.shiro:shiro-webMaven |
1.2.4 up to 3.0.0, plus listed versions 1.10.01.10.11.11.01.12.01.13.0 Show 34 moreShow less1.2.51.2.61.3.01.3.11.3.21.4.01.4.0-RC21.4.11.4.21.5.01.5.11.5.21.5.31.6.01.7.01.7.11.8.01.9.01.9.12.0.02.0.0-alpha-12.0.0-alpha-22.0.0-alpha-32.0.0-alpha-42.0.12.0.22.0.32.0.42.0.52.0.62.1.02.2.02.2.13.0.0-alpha-1 |
3.0.0 |
shiroUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2 |
None known |
shiroUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.2-21.3.2-3~18.041.3.2-3~18.04.11.3.2-3ubuntu0.18.04.1~esm1 |
None known |
shiroUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-4ubuntu0.11.3.2-4ubuntu0.2 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
shiroUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-5 |
None known |
shiroUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.3.2-51.3.2-5ubuntu0.24.04.1~esm1 |
None known |
shiroUbuntu:25.10 |
All versions, plus listed versions 1.3.2-6ubuntu1 |
None known |
shiroUbuntu:26.10 |
All versions, plus listed versions 1.3.2-6ubuntu2 |
None known |
shiroUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.2-6ubuntu11.3.2-6ubuntu2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, references | OSV | |
| affected, facts, references | GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-56130 is a low vulnerability (CVSS 2.0) in Apache Software Foundation Shiro, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in org.apache.shiro:shiro-core 3.0.0.