{"id":"CVE-2026-56130","kind":"vulnerability","aliases":["CVE-2026-56130","GHSA-m8g6-vrr2-x7ff"],"related":[],"title":"Apache Shiro's \"remember me\" cookie age is not verified on the server.","description":"\"Remember me\" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed.\nThis issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.\n\n\nUpgrade to version 3.0.0 or later, which fixes the issue.","summary":"Apache Shiro does not check the age of its \"remember me\" cookie on the server, so an expired cookie still logs a user in. An attacker who intercepts a valid cookie can reuse it indefinitely.","severity":"low","cvss":2.0,"epss":0.00299,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.shiro:shiro-core","fixed":["3.0.0"],"affected":">= 1.2.4, < 3.0.0","ecosystem":"maven"},{"name":"org.apache.shiro:shiro-web","fixed":["3.0.0"],"affected":">= 1.2.4, < 3.0.0","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["apache-shiro","cwe-294","java","maven","package","self-hosted"],"not_affected_if":["default-config","rememberme-disabled"],"how_to_check":"- Check the version of `org.apache.shiro:shiro-core` and `org.apache.shiro:shiro-web` in the project's Maven dependencies.\n- Confirm whether RememberMe is enabled in the Shiro configuration (`rememberMe` manager or cookie settings).","fix":"- Upgrade `org.apache.shiro:shiro-core` and `org.apache.shiro:shiro-web` to `3.0.0` or later.","status":"open","published_at":"2026-06-25T09:16:46+00:00","first_seen_at":"2026-11-03T21:30:11+00:00","triaged_at":"2026-11-03T21:31:01+00:00","updated_at":"2026-11-03T22:07:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T21:31:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.apache.shiro:shiro-core` and `org.apache.shiro:shiro-web` to `3.0.0` or later.","reach":"internet","title":"Apache Shiro: expired remember-me cookies are still accepted by the server","impact":"medium","summary":"Apache Shiro does not check the age of its \"remember me\" cookie on the server, so an expired cookie still logs a user in. An attacker who intercepts a valid cookie can reuse it indefinitely.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","maven","apache-shiro","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Expired remember-me cookie reused to log in as the victim","analyst_note":"","how_to_check":"- Check the version of `org.apache.shiro:shiro-core` and `org.apache.shiro:shiro-web` in the project's Maven dependencies.\n- Confirm whether RememberMe is enabled in the Shiro configuration (`rememberMe` manager or cookie settings).","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","rememberme-disabled"],"who_is_affected":"Only applications that use Apache Shiro 1.2.4 through 2.x (or 3.0.0-alpha-1) with RememberMe turned on are exposed. Applications without the remember-me feature enabled are not affected. The risk requires an attacker to first intercept a valid remember-me cookie.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00071,"input_tokens":4284,"output_tokens":564,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-1':126C '-2026':15A,23A '-294':37B '-56130':16A,24A '1.2.4':119C '2':121C '3.0.0':124C,136C 'affect':113C 'age':7A,50B,82C 'allow':91C 'alpha':125C 'apach':1A,34B,44B,115C 'apache-shiro':33B 'attack':69B,93C 'check':48B 'configur':106C 'cooki':6A,55B,62B,74B,81C,98C 'core':28A 'cve':14A,22A 'cwe':36B 'enabl':132C 'even':103C 'expir':61B,107C 'fix':140C 'function':130C 'ghsa':18A 'ghsa-m8g6-vrr2-x7ff':17A 'host':43B 'indefinit':78B,102C 'intercept':71B,95C 'issu':112C,142C 'java':38B 'later':138C 'log':64B 'm8g6':19A 'maven':39B 'org.apache.shiro':25A,29A 'packag':40B 'pass':110C 'potenti':90C 'rememb':4A,53B,79C 'rememberm':129C 'reus':76B,100C 'self':42B 'self-host':41B 'server':13A,58B,88C 'shiro':2A,27A,31A,35B,45B,116C 'shiro-core':26A 'shiro-web':30A 'still':63B 'time':108C 'upgrad':133C 'user':66B 'valid':73B,97C 'verifi':10A,85C 'version':117C,135C 'vrr2':20A 'web':32A 'x':122C 'x7ff':21A","nicknames":[],"mitigations":[],"who_affected":"Only applications that use Apache Shiro 1.2.4 through 2.x (or 3.0.0-alpha-1) with RememberMe turned on are exposed. Applications without the remember-me feature enabled are not affected. The risk requires an attacker to first intercept a valid remember-me cookie.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["orgapacheshiroshirocore","orgapacheshiroshiroweb"],"ptokens":["apache","core","org","shiro","web"],"labels":["apacheshiro","cwe294","java","low","maven","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-06-25T09:16:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:D/RE:L/U:Green","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-m8g6-vrr2-x7ff","url":"https://github.com/advisories/GHSA-m8g6-vrr2-x7ff","severity":"low","published_at":"2026-06-25T09:31:23+00:00","modified_at":"2026-11-03T21:25:28+00:00","first_seen_at":"2026-11-03T21:30:11+00:00","fetched_at":"2026-11-03T21:35:16+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-56130","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56130","severity":null,"published_at":"2026-06-25T09:16:46+00:00","modified_at":"2026-10-25T23:10:00+00:00","first_seen_at":"2026-11-03T22:07:19+00:00","fetched_at":"2026-11-03T22:07:19+00:00","note":null}],"documents":[{"id":60975,"url":"https://github.com/apache/shiro/commit/e441ea37009a426b122c53b0120ae5879d00e354","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}