Live › vulnerability › CVE-2026-56130
Apache Shiro does not check the age of its "remember me" cookie on the server, so an expired cookie still logs a user in. An attacker who intercepts a valid cookie can reuse it indefinitely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:30 UTC, 1h before NVD. All times on this page are UTC.
Only applications that use Apache Shiro 1.2.4 through 2.x (or 3.0.0-alpha-1) with RememberMe turned on are exposed. Applications without the remember-me feature enabled are not affected. The risk requires an attacker to first intercept a valid remember-me cookie.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.shiro:shiro-core | maven | >= 1.2.4, < 3.0.0 | 3.0.0 |
| org.apache.shiro:shiro-web | maven | >= 1.2.4, < 3.0.0 | 3.0.0 |
org.apache.shiro:shiro-core and org.apache.shiro:shiro-web in the project's Maven dependencies.rememberMe manager or cookie settings).org.apache.shiro:shiro-core and org.apache.shiro:shiro-web to 3.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.
Upgrade to version 3.0.0 or later, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-56130")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.