Bug 2481287 (CVE-2026-43827) - CVE-2026-43827 apache-shiro: Apache Shiro: Session fixation vulnerability due to improper session invalidation upon login
Summary: CVE-2026-43827 apache-shiro: Apache Shiro: Session fixation vulnerability due...
Keywords:
Status: NEW
Alias: CVE-2026-43827
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-25 21:01 UTC by OSIDB Bzimport
Modified: 2026-07-01 02:03 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-25 21:01:13 UTC 
Default configurations of Apache Shiro have a session fixation vulnerability.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.
Note You need to log in before you can comment on or make changes to this bug.