CVE-2026-43827 Apache Shiro: Session fixation: new session is not created after login by default
Attackers can hijack user sessions because Apache Shiro does not regenerate session IDs after login by default, allowing session fixation attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-43827?
CVE-2026-43827 is a medium-severity authentication bypass vulnerability in Apache Shiro, published on 25 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Default configurations of Apache Shiro have a session fixation vulnerability.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.
Weakness: CWE-384
Which versions are affected by CVE-2026-43827?
4 open source packages ship an affected version, including org.apache.shiro:shiro-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.shiro:shiro-core Maven | From 1.0.0-incubating | 2.2.0 |
org.apache.shiro:shiro-core Maven | From 1.0.0-incubating | 2.2.0 |
org.apache.shiro:shiro-core Maven | From 3.0.0-alpha-1 | 3.0.0-alpha-2 |
org.apache.shiro:shiro-core Maven | From 3.0.0-alpha-1 | 3.0.0-alpha-2 |
Products include Apache Shiro.
How do I fix CVE-2026-43827?
Upgrade org.apache.shiro:shiro-core to a fixed version for your release line: 2.2.0 or 3.0.0-alpha-2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-43827 being exploited?
There is no known exploitation of CVE-2026-43827 in the wild and no public exploit code.
Other vulnerabilities in Apache Shiro
- CVE-2023-34478 Path Traversal in Apache Shiro
- CVE-2022-40664 Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
- CVE-2022-32532 Authentication Bypass Vulnerability
- CVE-2021-41303 Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass
- CVE-2020-17523 Authentication bypass in Apache Shiro
Sources
Also known as CLEANSTART-2026-YW87633, DEBIAN-CVE-2026-43827, ECHO-46dc-0019-0617, GHSA-fcvm-3cpj-f9qx, MINI-324g-j2h7-g92f, MINI-3456-qm86-wgrf and 22 more.