Session Fixation Vulnerability in Apache Shiro by Apache Software Foundation

CVE-2026-43827

What is CVE-2026-43827?

Apache Shiro versions 1.0 through 2.1.0 and 3.0.0-alpha-1 exhibit a session fixation vulnerability. In these versions, if a session already exists at the time of a successful login, the session is not invalidated, and a new session ID is not created. This behavior permits an attacker to exploit the session fixation vector, potentially leading to unauthorized actions under the victim’s session. Users are strongly recommended to upgrade to Apache Shiro version 2.1.1 or 3.0.0-alpha-2 or later, which effectively resolves this issue. For more information, refer to the vendor's security reports.

References