{"id":"CVE-2026-43828","published":"2026-05-25T20:19:26Z","modified":"2026-05-26T12:38:38Z","title":"Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default","vendor":"Apache","product":"Apache Shiro","tier":"tail","description":{"text":"Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.\n\n\n\nThis issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.\n\nUsers are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.\n\nIn the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:L/U:Amber","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00272,"percentile":0.19532,"provenance":"source"},"cwes":[{"id":"CWE-614","name":"Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"}],"references":[{"url":"https://shiro.apache.org/security-reports.html#cve_2026_43828","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/25/7","tags":[]}],"priority":{"score":8.0,"factors":[{"name":"EPSS percentile","points":3.91},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Shiro","versions":[">= 1.0, <= 2.1.0",">= 3.0.0-alpha-0, <= 3.0.0-alpha-1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-web","vulnerableRanges":[">=1.0.0-incubating, <2.2.0",">=3.0.0-alpha-1, <3.0.0-alpha-2"],"patched":["2.2.0","3.0.0-alpha-2"],"from":["GHSA-c6r4-qjmw-cvj2"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-31734","exploited":false,"provenance":"source"}}