CVE-2026-43827

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

Default configurations of Apache Shiro have a session fixation vulnerability.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-438286.5Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache ShirCVE-2026-438297.5A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution CVE-2026-438309.8A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.CVE-2026-438317.5A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code executiCVE-2026-438327.5A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution CVE-2026-438335.3A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.CVE-2026-438347.5A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code executiCVE-2026-438358.6A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentCVE-2026-438369.3A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.CVE-2026-438377.5A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve codeCVE-2026-438389.2A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.CVE-2026-438398.7A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.