# CVE-2026-43827: Apache Shiro session fixation in default configuration

Source: https://junglewise.ai/threats/cve-2026-43827-apache-shiro-session-fixation-in-default-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-43827 · Severity: medium · CVSS 4 · Published 2026-05-25

Apache Shiro, a widely used security framework for Java applications, contains a flaw in its default configuration that fails to refresh user session identifiers after a successful login. This could allow an attacker to hijack a legitimate user's session if they can first trick the user into using a pre-defined session ID. If exploited, an attacker could gain unauthorized access to the user's account and sensitive data within the application.

Technologies: [Apache Shiro](https://junglewise.ai/threats/technologies/shiro), [org.apache.shiro:shiro-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-shiro-shiro-core). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-43827 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43827 being exploited in the wild.

**How severe is CVE-2026-43827?** Medium severity, with a CVSS score of 4, published 25 May 2026.

**Which products and versions are affected?** Apache Shiro 1.0 to 2.1.0, 3.0.0-alpha-1; org.apache.shiro:shiro-core (Maven) ECOSYSTEM:introduced=1.0.0-incubating,fixed=2.2.0.

**Is there a fix for CVE-2026-43827?** Yes. org.apache.shiro:shiro-core (Maven): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43827 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-43827?** Check whether you run Apache Shiro or org.apache.shiro:shiro-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.shiro:shiro-core (Maven): upgrade to 2.2.0 or later

  ```sh
  # set org.apache.shiro:shiro-core to 2.2.0 in your pom.xml or build.gradle
  ```


## Technical details

A session fixation vulnerability (CWE-384) exists in Apache Shiro's default configuration. The root cause is that the framework does not invalidate an existing session or rotate the session ID when a user successfully authenticates. An attacker can exploit this by providing a known session identifier to a victim's browser; once the victim logs in using that identifier, the attacker can use the same ID to access the authenticated session. This affects versions 1.0 through 2.1.0 and 3.0.0-alpha-1. The issue is resolved in versions 2.2.0 and 3.0.0-alpha-2 by ensuring a new session ID is generated upon login.

## Affected products

- Apache Shiro 1.0 to 2.1.0, 3.0.0-alpha-1

## Identifiers

- CVE-2026-43827
- GHSA-fcvm-3cpj-f9qx

## Timeline

- 2026-05-25: disclosed: Initial disclosure by Apache Software Foundation
- 2026-05-26: advisory: GitHub Advisory published

## References

- [https://shiro.apache.org/security-reports.html](https://shiro.apache.org/security-reports.html)
- [http://www.openwall.com/lists/oss-security/2026/05/25/6](http://www.openwall.com/lists/oss-security/2026/05/25/6)

## Related threats

- [Apache Shiro SSRF in Jakarta EE integration module](https://junglewise.ai/threats/cve-2026-58301-apache-shiro-ssrf-in-jakarta-ee-integration-module)
- [Apache Shiro authentication bypass via RememberMe cookie replay](https://junglewise.ai/threats/cve-2026-56130-apache-shiro-authentication-bypass-via-rememberme-cookie-replay)
- [Apache Shiro LDAP injection in DefaultLdapRealm](https://junglewise.ai/threats/cve-2026-49268-apache-shiro-ldap-injection-in-defaultldaprealm)
- [Apache Shiro open redirect in Jakarta EE module](https://junglewise.ai/threats/cve-2026-48589-apache-shiro-open-redirect-in-jakarta-ee-module)
- [Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability](https://junglewise.ai/threats/cve-2026-23901-apache-shiro-affected-by-an-observable-timing-discrepancy)