CVE-2026-43827: Apache Shiro has a session fixation vulnerability

May 26, 2026 (updated June 30, 2026)

Default configurations of Apache Shiro have a session fixation vulnerability.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.

References

github.com/advisories/GHSA-fcvm-3cpj-f9qx
nvd.nist.gov/vuln/detail/CVE-2026-43827
shiro.apache.org/security-reports.html

Code Behaviors & Features

Detect and mitigate CVE-2026-43827 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →