Vulnerability · Published May 25, 2026 · Assigned by apache
CVE-2026-43827Apache Shiro: Session fixation: new session is not created after login by default
Medium 5.9
In plain English
A medium-severity session fixation in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | shiro | no fix listed | DEBIAN-CVE-2026-43827 |
| Debian:13 | shiro | no fix listed | DEBIAN-CVE-2026-43827 |
| Debian:14 | shiro | no fix listed | DEBIAN-CVE-2026-43827 |
| Maven | org.apache.shiro:shiro-core | 2.2.0 | GHSA-fcvm-3cpj-f9qx |
| Maven | org.apache.shiro:shiro-core | 3.0.0-alpha-2 | GHSA-fcvm-3cpj-f9qx |
| Ubuntu:22.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-43827 |
| Ubuntu:25.10 | shiro | no fix listed | UBUNTU-CVE-2026-43827 |
| Ubuntu:26.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-43827 |
| Ubuntu:26.10 | shiro | no fix listed | UBUNTU-CVE-2026-43827 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Shiro | 1.0 – through 2.1.03.0.0-alpha-0 – through 3.0.0-alpha-1 |
Weakness: CWE-384 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber