org.apache.shiro:shiro-web vulnerabilities (Maven)

6 vulnerabilities.

• org.apache.shiro:shiro-web Maven Apache Shiro: Remember-me cookie isn't checked for expiry on the server CVE-2026-56130 Fix available 2.0 LowJune 25, 2026
• org.apache.shiro:shiro-web Maven Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default CVE-2026-43828 Fix available 5.9 MediumMay 25, 2026
• org.apache.shiro:shiro-web Maven Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro. CVE-2023-46750 Fix available 6.1 MediumDecember 14, 2023
• org.apache.shiro:shiro-web Maven Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests. CVE-2023-34478 Public exploitFix available 9.8 CriticalJuly 24, 2023
• org.apache.shiro:shiro-web Maven Authentication bypass in Apache Shiro CVE-2020-17523 Public exploitFix available EPSS 85.9% 9.8 CriticalFebruary 3, 2021
• org.apache.shiro:shiro-web Maven Improper Access Control in Apache Shiro CVE-2016-6802 Fix available 7.5 HighSeptember 20, 2016