Executive brief
Apache Shiro, a widely used security framework for Java applications, contains a flaw in its default configuration that fails to refresh user session identifiers after a successful login. This could allow an attacker to hijack a legitimate user's session if they can first trick the user into using a pre-defined session ID. If exploited, an attacker could gain unauthorized access to the user's account and sensitive data within the application.
Technical details
A session fixation vulnerability (CWE-384) exists in Apache Shiro's default configuration. The root cause is that the framework does not invalidate an existing session or rotate the session ID when a user successfully authenticates. An attacker can exploit this by providing a known session identifier to a victim's browser; once the victim logs in using that identifier, the attacker can use the same ID to access the authenticated session. This affects versions 1.0 through 2.1.0 and 3.0.0-alpha-1. The issue is resolved in versions 2.2.0 and 3.0.0-alpha-2 by ensuring a new session ID is generated upon login.
Affected products
- Apache Shiro 1.0 to 2.1.0, 3.0.0-alpha-1
Timeline
- 2026-05-25: disclosed: Initial disclosure by Apache Software Foundation
- 2026-05-26: advisory: GitHub Advisory published