Shiro Jakarta EE form replay may expose form data (CVE-2026-88019)
Original title: CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data
Only shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2 is listed, at CVSS 4.0 6.0.
Apache Shiro's Jakarta EE integration can weaken security when a saved form is resubmitted after login. The advisory says the automatic form-saving feature may expose form data and weaken cookies set by the application. shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2 is affected. CVSS 4.0 is 6.0 (medium), and the description is cut off.
Unconfirmed: The snippet cuts off before explaining which cookies are weakened.
- The issue requires the Jakarta EE integration module.
- User interaction is part of the published CVSS vector.
- The post was published on November 13.
- Fixed version stated by the affected range is 3.0.2.
Impact: Saved form replay may expose form data and weaken cookies
| Product | Affected | Fixed in |
|---|---|---|
| Apache Shiro shiro-jakarta-ee | 2.0.0-alpha-0 before 3.0.2 | 3.0.2 |
- 1.Upgrade org.apache.shiro:shiro-jakarta-ee to 3.0.2.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88019 | — | — | — |
From the original article
Posted by Lenny Primak on Nov 13 Severity: CVSS 4. 0: 6. 0 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.