Apache Shiro before 3.0.1 allows session fixation via RememberMe
Original title: CVE-2026-74762: Apache Shiro: Possible session fixation with RememberMe
shiro-core and shiro-web before 3.0.1 are affected; CVSS 4.0 is 5.9, rated medium.
Lenny Primak reported CVE-2026-74762 in Apache Shiro on November 13. Affected releases of shiro-core and shiro-web before 3.0.1 can allow session fixation when a user authenticates through the Remember me function. The posted description is cut off after stating that, in affected versions, when a subject is authenticated this way.
Unconfirmed: The description is truncated, so the full attack conditions are not stated.
- CVSS 4.0 score is 5.9 and rated medium.
- Both org.apache.shiro:shiro-core and shiro-web before 3.0.1 are listed.
- The advisory was posted to oss-security on November 13.
Impact: session fixation after RememberMe authentication
| Product | Affected | Fixed in |
|---|---|---|
| Apache Shiro (shiro-core) | before 3.0.1 | 3.0.1 |
| Apache Shiro (shiro-web) | before 3.0.1 | 3.0.1 |
- 1.Upgrade shiro-core and shiro-web to 3.0.1 or later.
- CVEs
- CVE-2026-74762
- Vendors
- Apache
- Products
- Apache Shiroshiro-coreshiro-web
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74762 | — | — | — |
From the original article
Posted by Lenny Primak on Nov 13 Severity: CVSS 4. 0: 5. 9 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.