CVE-2026-56130Low▾ Sunlit

Apache Shiro's "remember me" cookie age is not verified on the server.

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score14/ 100 · Minimal

impact 13.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 25, 2026

Updated

Nov 3, 2026

CVSS

—

Vendor

apache

Product

org.apache.shiro:shiro-core

CWE

CWE-294

Depth score

14 · Minimal

EPSS

0.30% · p23

Platforms

—

Source

GHSA

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Nov 3.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 131 days

Jun 25, 2026Published
Disclosed via GHSA
Nov 3, 2026Record revised
Last analysed / modified upstream
Nov 3, 2026EPSS first tracked
0.3%

apache CWE-294 #ghsa #maven

Affected

org.apache.shiro:shiro-core >= 1.2.4, < 3.0.0
org.apache.shiro:shiro-web >= 1.2.4, < 3.0.0

Patched in

org.apache.shiro:shiro-core 3.0.0
org.apache.shiro:shiro-web 3.0.0

Full technical detail▾

Overview

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.

Upgrade to version 3.0.0 or later, which fixes the issue.

Affected packages

org.apache.shiro:shiro-core >= 1.2.4, < 3.0.0
org.apache.shiro:shiro-web >= 1.2.4, < 3.0.0

Remediation

Upgrade to a patched release:

org.apache.shiro:shiro-core 3.0.0
org.apache.shiro:shiro-web 3.0.0

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#ghsa#maven