CVE-2026-43828

published 2026-05-25

CVE-2026-43828: Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0…

medium 5.9 CVSS 4.0

AV N AC L AT P PR N UI A VC H VI N VA N SC L SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU Y R U V X RE L U Amber

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	shiro	< 2.1.1	2.1.1
apache	shiro	—	—
apache_software_foundation	apache_shiro	1.0 – 2.1.0	—
apache_software_foundation	apache_shiro	3.0.0-alpha-0 – 3.0.0-alpha-1	—

CVSS provenance

nvd v4.0 5.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber

cvelistv5 v4.0 5.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber

CWE-614