Severity:
CVSS 4.0: 6.0 (medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber
Affected versions:
- Apache Shiro (org.apache.shiro:shiro-jakarta-ee) 2.0.0-alpha-0 before 3.0.2
Description:
When Apache Shiro is used with the Jakarta EE integration module, the automatic
form saving feature weakens the security of a form that is resubmitted after
login.
Cookies set by the application during the resubmission could lose their
security attributes, such as `Secure` and `SameSite`.
In addition, the resubmitted form data and cookies could be sent to an
untrusted host.
This issue affects Apache Shiro from 2.0.0-alpha through 3.0.1, only when using
`shiro-jakarta-ee` integration module with form saving enabled (the default).
Mitigation: Upgrade to version 3.0.2 or later, which no longer replays the form
over the network, and avoids this class of issues entirely.
Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String)
and `org.apache.shiro.form-resubmit-port` (Integer) system properties to
restrict the host and port that Shiro will connect to when resubmitting a form.
Credit:
Joshua Rogers (finder)
Wentao He (finder)
Lenny Primak <[email protected]> (remediation developer)
References:
https://shiro.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-88019
