GHSA-c6r4-qjmw-cvj2

Source

https://github.com/advisories/GHSA-c6r4-qjmw-cvj2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-c6r4-qjmw-cvj2/GHSA-c6r4-qjmw-cvj2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c6r4-qjmw-cvj2

Aliases

CVE-2026-43828

Published

2026-05-26T13:30:50Z

Modified

2026-06-30T17:32:40.631913312Z

Severity

5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/RE:L/U:Amber CVSS Calculator

Summary

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

Details

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

Database specific

{
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2026-05-25T21:16:34Z",
    "github_reviewed_at": "2026-06-30T17:27:51Z",
    "cwe_ids": [
        "CWE-614"
    ]
}

References

Affected packages

Maven / org.apache.shiro:shiro-web

Package

Name: org.apache.shiro:shiro-web; View open source insights on deps.dev
Purl: pkg:maven/org.apache.shiro/shiro-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0-incubating

Fixed

2.2.0

Affected versions

1.*

1.0.0-incubating

1.1.0

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.3.0

1.3.1

1.3.2

1.4.0-RC2

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.5.2

1.5.3

1.6.0

1.7.0

1.7.1

1.8.0

1.9.0

1.9.1

1.10.0

1.10.1

1.11.0

1.12.0

1.13.0

2.*

2.0.0-alpha-1

2.0.0-alpha-2

2.0.0-alpha-3

2.0.0-alpha-4

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-c6r4-qjmw-cvj2/GHSA-c6r4-qjmw-cvj2.json"