PatchTheCVECVE-2026-43828: Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
CVE-2026-43828 is a medium-severity flaw (CVSS 6.5) affecting shiro. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 81%) |
| CISA exploited list | No |
| Weakness | CWE-614 |
| Published | 2026-05-25 |
| Last modified | 2026-07-24 |
Last updated 2026-07-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-43828?
shiro: upgrade to 2.1.1. Exact commands for each OS are on this page.
Is CVE-2026-43828 being exploited?
CVE-2026-43828 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-43828 affect?
CVE-2026-43828 affects shiro. Severity is medium (CVSS 6.5). Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0
How urgent is CVE-2026-43828?
Priority 33/100. On your watchlist
Related CVEs
- CVE-2026-49268 CRITICAL 9.1 UPGRADE A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultL
- CVE-2026-58301 MEDIUM 6.5 UPGRADE When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP requ
- CVE-2026-43827 MEDIUM 6.5 UPGRADE Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro
- CVE-2026-44598 MEDIUM 5.4 UPGRADE With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery
- CVE-2026-48589 MEDIUM 5.4 UPGRADE Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user