This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/main by this push:
new 4838a2699 fix: corrected CVE number for remember-me vulnerability
4838a2699 is described below
commit 4838a2699074e7b23ee588b30a3566d79831a06a
Author: lprimak <[email protected]>
AuthorDate: Wed Jun 24 13:37:57 2026 -0500
fix: corrected CVE number for remember-me vulnerability
---
src/site/content/security-reports.adoc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/site/content/security-reports.adoc
b/src/site/content/security-reports.adoc
index 8090582e5..e47e8537c 100644
--- a/src/site/content/security-reports.adoc
+++ b/src/site/content/security-reports.adoc
@@ -41,7 +41,7 @@ Upgrade to version 3.0.0 or later, which fixes the issue.
**Credit:**
Apache Shiro would like to thank *LocalHost* for reporting this issue.
-=== link:https://www.cve.org/CVERecord?id=CVE-2026-49268[CVE-2026-49268]
+=== link:https://www.cve.org/CVERecord?id=CVE-2026-56130[CVE-2026-56130]
"Remember me" cookie age is not verified on the server. This potentially
allows an attacker to intercept a valid cookie and reuse it indefinitely, even
after the configured expiration time has passed.
This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and
3.0.0-alpha-1, only when RememberMe functionality is enabled.
