CVE-2026-43828: Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 2.1.1 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 3.0.0-alpha-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43828?
CVE-2026-43828 has a medium severity rating of 5.9 as per the CVSS score.
How do I fix CVE-2026-43828?
To fix CVE-2026-43828, update Apache Shiro to version 2.1.1 or 3.0.0-alpha-2 or later.
What is the impact of CVE-2026-43828?
CVE-2026-43828 allows sensitive cookies to be sent over HTTPS sessions without the 'Secure' attribute, potentially exposing them to interception.
Which versions of Apache Shiro are affected by CVE-2026-43828?
CVE-2026-43828 affects Apache Shiro versions from 1.0 up to 2.1.0, and 3.0.0-alpha-1.
Is there a workaround for CVE-2026-43828?
There is no specific workaround for CVE-2026-43828; upgrading to the patched versions is recommended.