GHSA-c6r4-qjmw-cvj2Medium

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

Published
May 26, 2026
Last Modified
June 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-43828 →

📋 Description

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

🎯 Affected products2

  • maven/org.apache.shiro:shiro-web:>= 1.0.0-incubating, < 2.2.0
  • maven/org.apache.shiro:shiro-web:= 3.0.0-alpha-1

🔗 References (4)