GHSA-m8g6-vrr2-x7ff

Source

https://github.com/advisories/GHSA-m8g6-vrr2-x7ff

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-m8g6-vrr2-x7ff/GHSA-m8g6-vrr2-x7ff.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m8g6-vrr2-x7ff

Aliases

CVE-2026-56130

Downstream

CGA (16)

MINI (2)

Published

2026-06-25T09:31:23Z

Modified

2026-11-03T21:45:42Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/V:D/RE:L/U:Green CVSS Calculator

Summary

Apache Shiro's "remember me" cookie age is not verified on the server.

Details

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.

Upgrade to version 3.0.0 or later, which fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-294"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-03T21:25:26Z",
    "nvd_published_at": "2026-06-25T09:16:46Z",
    "severity": "LOW"
}

References

Affected packages

Maven / org.apache.shiro:shiro-core

Package

Name: org.apache.shiro:shiro-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.shiro/shiro-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.2.4

Fixed

3.0.0

Affected versions

1.*

1.2.4

1.2.5

1.2.6

1.3.0

1.3.1

1.3.2

1.4.0-RC2

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.5.2

1.5.3

1.6.0

1.7.0

1.7.1

1.8.0

1.9.0

1.9.1

1.10.0

1.10.1

1.11.0

1.12.0

1.13.0

2.*

2.0.0-alpha-1

2.0.0-alpha-2

2.0.0-alpha-3

2.0.0-alpha-4

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.1.0

2.2.0

2.2.1

3.*

3.0.0-alpha-1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-m8g6-vrr2-x7ff/GHSA-m8g6-vrr2-x7ff.json"

Maven / org.apache.shiro:shiro-web