Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Shiro | 1.0 – 2.1.0; 3.0.0-alpha-0 – 3.0.0-alpha-1 | — | No fix listed | CNA |
| — | org.apache.shiro:shiro-web (Maven) | 1.0.0-incubating to before 2.2.0 | 2.2.0 | Patch available | GHSA-c6r4-qjmw-cvj2 |
| — | org.apache.shiro:shiro-web (Maven) | 3.0.0-alpha-1 to before 3.0.0-alpha-2 | 3.0.0-alpha-2 | Patch available | GHSA-c6r4-qjmw-cvj2 |
- Apache Shiro VendorApache Affected 1.0 – 2.1.0; 3.0.0-alpha-0 – 3.0.0-alpha-1 Fixed in — No fix listed CNA
- org.apache.shiro:shiro-web (Maven) Vendor— Affected 1.0.0-incubating to before 2.2.0 Fixed in 2.2.0 Patch available GHSA-c6r4-qjmw-cvj2
- org.apache.shiro:shiro-web (Maven) Vendor— Affected 3.0.0-alpha-1 to before 3.0.0-alpha-2 Fixed in 3.0.0-alpha-2 Patch available GHSA-c6r4-qjmw-cvj2
Remediation
- Fix · GHSA-c6r4-qjmw-cvj2 org.apache.shiro:shiro-web (Maven) Fixed in 2.2.0 Advisory →
- Fix · GHSA-c6r4-qjmw-cvj2 org.apache.shiro:shiro-web (Maven) Fixed in 3.0.0-alpha-2 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache Shiro — shiro.apache.org/security-reports.html
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-31916 Apache Shiro: Session fixation: new session is not created after login by defaultPriority LOW 27
- TI-2026-35945 Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flowPriority LOW 3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-43828
- 2026-10-03 Alias added: GHSA-c6r4-qjmw-cvj2
References
More Apache Shiro vulnerabilities
- TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-13272 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2021-18132 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2022-14167 Authentication bypass in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2020-09649 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
- TI-2020-10910 Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. CVSS 3.1HIGH 7.5
Sources
- CVE-2026-43828 · CVE Program
- CVE-2026-43828 · NVD
- FIRST EPSS
- GHSA-c6r4-qjmw-cvj2 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-43828 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences