Is there a patch available for CVE-2026-43827?

Yes, a patch is available for CVE-2026-43827. Update the affected software to the latest version immediately.

Apache Shiro CVE-2026-43827

Q: What is the CVSS score of CVE-2026-43827?

CVE-2026-43827 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-31736 MEDIUM

Session Fixation (CWE-384)

2026-05-25 apache

GHSA-fcvm-3cpj-f9qx

Session Fixation Information Disclosure Apache Apache Shiro Red Hat

5.9

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber

vuln.today AI

6.1 MEDIUM

Requires victim-coordinated authentication with attacker-planted session ID (AC:H, UI:R, PR:N); scope changes to authenticated context (S:C, C:H); no direct integrity or availability impact per vendor-confirmed disclosure impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.1 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:15 vuln.today

CVE Published

May 25, 2026 - 20:19 nvd

UNKNOWN (no severity yet)

CVE Published

May 25, 2026 - 20:19 cve.org

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

63 maven packages depend on org.apache.shiro:shiro-core (23 direct, 40 indirect)

Ecosystem-wide dependent count for version 1.0.0-incubating.

DescriptionCVE.org

Default configurations of Apache Shiro have a session fixation vulnerability.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.

AnalysisAI

Session fixation in Apache Shiro 1.0 through 2.1.0 and 3.0.0-alpha-1 exposes authenticated user sessions to hijacking because the framework's default configuration neither invalidates the pre-existing session nor rotates the session ID upon successful login. An unauthenticated remote attacker who plants a known session token before the victim authenticates can reuse that token post-login to access the victim's authenticated context, resulting in high confidentiality impact to the vulnerable system. No public exploit has been identified at time of analysis; EPSS at 0.04% (13th percentile) and SSVC exploitation status of 'none' both reflect negligible observed exploitation activity.

Technical ContextAI

Apache Shiro (cpe:2.3:a:apache_software_foundation:apache_shiro) is a widely-adopted Java security framework providing authentication, authorization, cryptography, and session management across enterprise Java applications. The root cause is CWE-384 (Session Fixation): Shiro's default session handler does not call session invalidation or ID rotation during the authentication state transition. OWASP and RFC best practices require that a new session identifier be issued whenever a principal's privilege level changes - specifically at login - to prevent pre-authentication tokens from retaining validity post-login. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) captures that the attack requires the adversary to pre-establish a session ID the victim will reuse, typically via cookie injection, URL parameter manipulation, or a complementary XSS channel, rather than being a purely passive exploitation path.

RemediationAI

Vendor-released patch: upgrade to Apache Shiro 2.1.1 for users on the stable 2.x branch, or to 3.0.0-alpha-2 or later for alpha-branch adopters. Both releases implement proper session ID invalidation and rotation upon successful authentication. Full advisory details are available at https://shiro.apache.org/security-reports.html#cve_2026_43827 and the oss-security disclosure at http://www.openwall.com/lists/oss-security/2026/05/25/6. If immediate patching is not feasible, a targeted compensating control is to implement a custom Shiro AuthenticationListener that explicitly invalidates the current session and forces creation of a new session ID immediately after a successful login event - this requires application-level code changes and should be tested for session state continuity side effects. Additionally, enforcing aggressively short session timeouts reduces the usable window for a pre-planted token but does not eliminate the root cause vulnerability.