This is an automated email from the ASF dual-hosted git repository. lprimak pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/shiro-site.git
commit 49701534ff6fe78b6dfbd84805ac6db3189eaf45 Author: lprimak <[email protected]> AuthorDate: Sun May 3 14:45:59 2026 -0500 added unsecure cookies CVE --- src/site/content/security-reports.adoc | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/site/content/security-reports.adoc b/src/site/content/security-reports.adoc index 8e9e91a42..a5ffa92d7 100644 --- a/src/site/content/security-reports.adoc +++ b/src/site/content/security-reports.adoc @@ -37,7 +37,17 @@ Default configurations of Apache Shiro have a session fixation vulnerability. Th Upgrade to version 2.1.1, 3.0.0-alpha-2 or later, which fixes the issue. **Credit:** -Rasmus Moorats +Apache Shiro would like to thank *Rasmus Moorats* for reporting this issue. + +=== link:https://www.cve.org/CVERecord?id=CVE-2026-43828[CVE-2026-43828] +Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. + +In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without `secure` attribute by default. + +**Mitigation:** +Upgrade to version 2.1.1, 3.0.0-alpha-2 or later, which fixes the issue. + +**Credit:** +Apache Shiro would like to thank *Meteor_Kai* for reporting this issue. === link:https://www.cve.org/CVERecord?id=CVE-2026-23903[CVE-2026-23903]
