CVE-2026-43827

Name of the Vulnerable Software and Affected Versions Apache Shiro versions 1.0 through 2.1.0 Apache Shiro version 3.0.0-alpha-1

Description Default configurations contain a session fixation issue. In the affected versions, when a session already exists, it is not invalidated upon successful login, and a new session ID is not generated. Session fixation is a technique where an attacker provides a valid session ID to a user and then waits for the user to authenticate, allowing the attacker to hijack the authenticated session.

Recommendations Upgrade to version 2.1.1 for versions 1.0 through 2.1.0. Upgrade to version 3.0.0-alpha-2 or later for version 3.0.0-alpha-1.