Is there a patch available for CVE-2026-43828?

Yes, a patch is available for CVE-2026-43828. Update the affected software to the latest version immediately.

Apache Shiro CVE-2026-43828

Q: What is the CVSS score of CVE-2026-43828?

CVE-2026-43828 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber. EPSS exploitation probability: 0.0%.

EUVD-2026-31734 MEDIUM

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614)

2026-05-25 apache

GHSA-c6r4-qjmw-cvj2

Apache Information Disclosure Red Hat Apache Shiro Apache Software Foundation

5.9

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:Amber

vuln.today AI

5.3 MEDIUM

AC:H reflects the required network intercept position (AT:P in 4.0); UI:R because victim must send HTTP request; no integrity or availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:15 vuln.today

CVE Published

May 25, 2026 - 20:19 nvd

UNKNOWN (no severity yet)

CVE Published

May 25, 2026 - 20:19 cve.org

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

41 maven packages depend on org.apache.shiro:shiro-web (11 direct, 30 indirect)

Ecosystem-wide dependent count for version 1.0.0-incubating.

DescriptionCVE.org

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

AnalysisAI

Apache Shiro's default session and RememberMe cookie configuration omits the 'Secure' attribute, exposing JSESSIONID and rememberMe tokens to interception on any non-TLS channel in applications running versions 1.0 through 2.1.0 and 3.0.0-alpha-1. Successful exploitation allows an attacker with a network intercept position to capture and replay session or persistent-authentication tokens, fully hijacking an authenticated user's session. No public exploit has been identified and CISA has not listed this in KEV; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation, making this primarily a risk in mixed HTTP/HTTPS or network-adjacent threat environments.

Technical ContextAI

CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute) identifies the root cause: a missing browser security flag rather than a code execution flaw. Apache Shiro is a widely used Java security framework (CPE: cpe:2.3:a:apache_software_foundation:apache_shiro:*:*:*:*:*:*:*:*) providing authentication, authorization, session management, and cryptography. Its native session manager issues JSESSIONID cookies to maintain stateful sessions, and its RememberMe manager issues persistent authentication cookies. Without the Secure flag, RFC 6265 permits browsers to transmit these cookies over plain HTTP connections - enabling passive interception in mixed-content scenarios, HTTP downgrade attacks, or any network segment where HTTP traffic is observable. The vulnerability is entirely a configuration default issue in the cookie issuance layer, not a flaw in Shiro's cryptographic or authentication logic.

RemediationAI

Upgrade to Apache Shiro 2.1.1 (stable branch) or 3.0.0-alpha-2 or later (alpha branch), as confirmed by the vendor advisory at https://shiro.apache.org/security-reports.html#cve_2026_43828. These releases fix the default cookie configuration to include the Secure attribute. If immediate upgrade is not feasible, explicitly configure the Shiro SessionManager and RememberMeManager to set cookieSecure=true (or equivalent property) in your Shiro configuration file - this resolves the misconfiguration without requiring a library upgrade but must be re-verified after any upgrade to confirm the default does not re-override it. Deploying HTTP Strict Transport Security (HSTS) at the web server or load balancer layer reduces the attack surface by preventing HTTP downgrade scenarios, but does not fix the underlying missing Secure flag and carries the trade-off of requiring a valid TLS certificate covering all subdomains if includeSubDomains is used. Disabling the RememberMe feature entirely in applications that do not require persistent login eliminates the rememberMe cookie exposure vector with no functional impact to session-only workflows.