CVE-2026-43828: Apache Shiro Sensitive Cookie Transmission Vulnerability
Summary
CVE-2026-43828: Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute. Affects org.apache.shiro:shiro-web across 2 version ranges.
>= 1.0.0-incubating, < 2.2.0
>= 3.0.0-alpha-1, < 3.0.0-alpha-2
Fixed in 2.2.0 or 3.0.0-alpha-2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Shiro is a powerful and flexible open-source security framework that provides authentication, authorization, cryptography, and session management capabilities for Java applications. It is widely used for securing web applications and services. However, certain versions of Apache Shiro have a vulnerability that exposes sensitive cookies in HTTPS sessions without the 'Secure' attribute, which can lead to potential security risks.
Vulnerability Detail
The vulnerability arises from the default configuration of Apache Shiro, which sends sensitive cookies, specifically JSESSIONID and rememberMe cookies, in HTTPS sessions without the 'Secure' attribute. This means that these cookies could be transmitted over unencrypted connections, making them susceptible to interception by attackers. The affected versions include Apache Shiro from 1.0 to 2.1.0 and 3.0.0-alpha-1. The absence of the 'Secure' attribute allows cookies to be sent over non-HTTPS connections, increasing the risk of session hijacking and unauthorized access.
How To Fix
Latest published version: 3.0.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0-incubating, < 2.2.02.2.0 -
>= 3.0.0-alpha-1, < 3.0.0-alpha-23.0.0-alpha-2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually configure the session manager and Remember-Me manager to include the 'Secure' attribute for cookies. This can be done by modifying the Shiro configuration file to set the secure flag for cookies, ensuring they are only sent over HTTPS connections.
Conclusion
In summary, the Apache Shiro vulnerability (CVE-2026-43828) poses a risk by transmitting sensitive cookies without the 'Secure' attribute in HTTPS sessions. Users are strongly advised to upgrade to the latest patched versions to protect their applications from potential security threats.
See every vulnerability recorded for org.apache.shiro:shiro-web →
FAQ
The impact includes the potential exposure of sensitive session cookies, which can lead to session hijacking and unauthorized access to user accounts.
The affected versions are Apache Shiro from 1.0 to 2.1.0 and 3.0.0-alpha-1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
If you cannot upgrade immediately, ensure that your application is configured to use the 'Secure' attribute for cookies to mitigate the risk until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shiro:shiro-web.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
