CVE-2026-43827: Apache Shiro Session Fixation Vulnerability
Summary
CVE-2026-43827: Apache Shiro has a session fixation vulnerability. Affects org.apache.shiro:shiro-core across 2 version ranges.
>= 1.0.0-incubating, < 2.2.0
>= 3.0.0-alpha-1, < 3.0.0-alpha-2
Fixed in 2.2.0 or 3.0.0-alpha-2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Shiro is a powerful and flexible open-source security framework that handles authentication, authorization, cryptography, and session management in Java applications. It is widely used due to its simplicity and ease of integration. However, certain default configurations in versions 1.0 to 2.1.0 and 3.0.0-alpha-1 expose users to a session fixation vulnerability, which can compromise session integrity and user security.
Vulnerability Detail
The session fixation vulnerability in Apache Shiro arises from its failure to invalidate existing sessions upon successful login. Instead of generating a new session ID, the framework continues to use the existing session, allowing attackers to hijack user sessions. This flaw can lead to unauthorized access to sensitive information and actions within the application, posing a significant security risk.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0-incubating, < 2.2.02.2.0 -
>= 3.0.0-alpha-1, < 3.0.0-alpha-23.0.0-alpha-2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement custom session management logic to invalidate existing sessions upon login. This can be done by overriding the login method to include session invalidation logic before creating a new session.
Conclusion
The session fixation vulnerability in Apache Shiro poses a significant risk to applications using affected versions. It is crucial for users to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for org.apache.shiro:shiro-core →
FAQ
Session fixation is a type of attack where an attacker sets a user's session ID to a known value, allowing them to hijack the session after the user logs in.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground to analyze your pom.xml without any signup.
If exploited, this vulnerability can allow attackers to gain unauthorized access to user accounts and sensitive data, potentially leading to data breaches.
Yes, not updating to the patched versions exposes your application to potential attacks, which can compromise user data and application integrity.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shiro:shiro-core.
