https://seclists.org/oss-sec/2026/q2/694: CVE-2026-43827: Apache Shiro: Session fixation: new session is not cated after login by default
Published May 25, 2026
·Updated
Affected Software
1 affected component
maven/org.apache.shiro/shiro-core>=1.0<=2.1.0, >=3.0.0-alpha-0<=3.0.0-alpha-1
Frequently Asked Questions
1
What is the severity of CVE-2026-43827?
CVE-2026-43827 is categorized as a session fixation vulnerability in Apache Shiro.
2
How do I fix CVE-2026-43827?
To fix CVE-2026-43827, upgrade Apache Shiro to version 2.1.1 or later, which addresses the session fixation issue.
3
Which versions of Apache Shiro are affected by CVE-2026-43827?
CVE-2026-43827 affects Apache Shiro versions 1.0 through 2.1.0 and 3.0.0-alpha-0 through 3.0.0-alpha-1.
4
What is the impact of CVE-2026-43827 on web application security?
The impact of CVE-2026-43827 is that it may allow attackers to hijack user sessions if the application uses default configurations.
5
Are there any recommended configurations to mitigate CVE-2026-43827?
To mitigate CVE-2026-43827, it is recommended to explicitly configure session management settings in Apache Shiro to prevent session fixation.