Live › vulnerability › CVE-2016-4437
Go to dashboardApache Shiro, a Java security and access-control library, has a flaw where a crafted request parameter can run code or bypass access checks when the "remember me" feature has no cipher key configured. Attackers can gain code execution on the server without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Shiro | vendor | – | – |
Search application config and code for the "remember me" setting (rememberMeManager / cipherKey) and confirm a cipher key is set; check the Shiro version in dependencies (pom.xml, build.gradle, or lockfile).
Upgrade Apache Shiro to a fixed release per the vendor advisory (fixed version unknown from sources), and set an explicit, strong rememberMe cipher key.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2016-4437")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.