Which versions of Apache Shiro are affected by EUVD-2026-39229?

Apache Shiro's RememberMe feature (versions 1.2.4-3.0.0-alpha-1) contains a session expiration bypass that renders configured session timeouts ineffective-attackers who intercept a RememberMe cookie…

How to fix or mitigate EUVD-2026-39229?

Within 24 hours: Inventory all Apache Shiro deployments; identify instances with RememberMe enabled; disable the RememberMe feature or activate WAF rules blocking suspicious cookie replay patterns. Within 7 days: Implement server-side session validation with strict timeout enforcement independent of cookie age; enforce HttpOnly, Secure, and SameSite cookie attributes; enable continuous session anomaly monitoring. Within 30 days: Evaluate upgrade options and monitor Apache Shiro security advisories for patch availability; for critical applications, consider migrating to stateless token-based authentication (JWT with short-lived tokens).

Apache Shiro EUVD-2026-39229

Q: What is the CVSS score of EUVD-2026-39229?

EUVD-2026-39229 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:D/RE:L/U:Green. EPSS exploitation probability: 0.2%.

| CVE-2026-56130 LOW

Authentication Bypass by Capture-replay (CWE-294)

2026-06-24

GHSA-m8g6-vrr2-x7ff

Apache Information Disclosure

2.0

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:D/RE:L/U:Green

vuln.today AI

7.4 HIGH

AC:H because exploitation requires prior cookie theft; C:H/I:H because replayed session grants full victim account access; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 25, 2026 - 09:23 NVD

2.0 (LOW)

Analysis Generated

Jun 24, 2026 - 20:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 2

News 3 New Java Vulnerabilities - 2 Critical, 1 High Severity Jun 25, 2026 News Critical Session Hijacking in Apache Shiro RememberMe - CVE-2026-56130 Jun 24, 2026

AnalysisAI

Insufficient session expiration in Apache Shiro's RememberMe feature allows a stolen cookie to be replayed indefinitely, bypassing the configured cookie age restriction. All shiro-web deployments from version 1.2.4 through the entire 2.x line and the 3.0.0-alpha-1 pre-release are affected whenever RememberMe is enabled. An attacker who intercepts a victim's RememberMe cookie - through network interception, XSS, or similar means - can reuse it without time limit, effectively maintaining persistent unauthorized access to the victim's session even after the configured expiration has elapsed. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Apache Shiro (org.apache.shiro:shiro-web) is a Java security framework providing authentication, authorization, session management, and cryptography for web applications. Its RememberMe feature issues a persistent cookie that re-authenticates users across browser restarts without requiring a full login. The root cause is that while the cookie carries a client-side expiry attribute (Max-Age or Expires), the server-side processing layer does not independently validate whether the cookie's age has exceeded the configured lifetime before honoring it. This is a classic CWE-613 (Insufficient Session Expiration) pattern: the server trusts the client's cookie presentation without enforcing a server-side temporal bound. Because Shiro's RememberMe cookies are cryptographically signed (using a configured cipher key), an attacker cannot forge a cookie from scratch - but a legitimately issued, stolen cookie remains valid server-side forever. Affected CPE: cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* for versions 1.2.4 through 2.99.99 and 3.0.0-alpha-0 through 3.0.0-alpha-1.

RemediationAI

Upgrade to Apache Shiro 3.0.0 or later, which is the vendor-confirmed fix version per the OSS-Security advisory (https://seclists.org/oss-sec/2026/q2/1019). Note that no patch has been released for the 2.x branch; this is a major-version upgrade, and teams should evaluate API and configuration compatibility before migrating. As a compensating control where immediate upgrade is not feasible, disable the RememberMe feature entirely - this eliminates the vulnerable code path at the cost of requiring users to re-authenticate on each session. If RememberMe cannot be disabled, consider implementing a server-side session store (e.g., a Redis-backed session cache) that enforces TTL independently of Shiro's cookie handling, and rotate the RememberMe cipher key regularly to invalidate outstanding cookies. Placing the application behind a WAF or reverse proxy that strips or blocks RememberMe cookies for sensitive endpoints may also limit exposure but does not address the root flaw.