{"id":"CVE-2026-56130","aliases":["GHSA-m8g6-vrr2-x7ff"],"title":"Apache Shiro's \"remember me\" cookie age is not verified on the server.","summary":"Apache Shiro's \"remember me\" cookie age is not verified on the server.","severity":"low","cwe":["CWE-294"],"vendor":"apache","product":"org.apache.shiro:shiro-core","ecosystem":"maven","affected":["org.apache.shiro:shiro-core >= 1.2.4, < 3.0.0","org.apache.shiro:shiro-web >= 1.2.4, < 3.0.0"],"patched":["org.apache.shiro:shiro-core 3.0.0","org.apache.shiro:shiro-web 3.0.0"],"published":"2026-06-25","updated":"2026-11-03","sourceUpdated":"2026-11-03T21:25:28Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-m8g6-vrr2-x7ff","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56130"},{"url":"https://lists.apache.org/thread/9k9b3bmlq516ylvf7cdp3dlrtdtmxbmo"},{"url":"http://www.openwall.com/lists/oss-security/2026/06/24/8"},{"url":"https://github.com/github/advisory-database/pull/10074"},{"url":"https://github.com/apache/shiro/commit/e441ea37009a426b122c53b0120ae5879d00e354"},{"url":"https://github.com/advisories/GHSA-m8g6-vrr2-x7ff"}],"tags":["ghsa","maven"],"epss":0.00299,"epssPercentile":0.22702,"ingestedAt":"2026-11-03T21:55:50.535Z","slug":"CVE-2026-56130","body":"## Overview\n\n\"Remember me\" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed.\nThis issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.\n\n\nUpgrade to version 3.0.0 or later, which fixes the issue.\n\n## Affected packages\n\n- `org.apache.shiro:shiro-core >= 1.2.4, < 3.0.0`\n- `org.apache.shiro:shiro-web >= 1.2.4, < 3.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.apache.shiro:shiro-core 3.0.0`\n- `org.apache.shiro:shiro-web 3.0.0`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}