GHSA-fcvm-3cpj-f9qxMedium

Apache Shiro has a session fixation vulnerability

Published
May 26, 2026
Last Modified
June 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-43827 →

📋 Description

Default configurations of Apache Shiro have a session fixation vulnerability.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.

🎯 Affected products2

  • maven/org.apache.shiro:shiro-core:>= 1.0.0-incubating, < 2.2.0
  • maven/org.apache.shiro:shiro-core:= 3.0.0-alpha-1

🔗 References (4)