Is CVE-2026-43828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43828 being exploited in the wild.

How severe is CVE-2026-43828?

Medium severity, with a CVSS score of 4, published 25 May 2026.

Which products and versions are affected?

org.apache.shiro:shiro-web (Maven) ECOSYSTEM:introduced=1.0.0-incubating,fixed=2.2.0.

Is there a fix for CVE-2026-43828?

Yes. org.apache.shiro:shiro-web (Maven): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43828 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-43828?

Check whether you run org.apache.shiro:shiro-web (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43828: Apache Shiro missing Secure attribute on sensitive cookies

CVE-2026-43828 · Severity: medium · CVSS 4 · Published 2026-05-25

Apache Shiro, a security framework for Java applications, fails to properly protect session cookies in its default configuration. This allows sensitive login and session information to be transmitted over unencrypted channels even when the website is using HTTPS. An attacker could potentially intercept these cookies to hijack a user's session and gain unauthorized access to their account.

Technologies: org.apache.shiro:shiro-web (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-43828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43828 being exploited in the wild.
How severe is CVE-2026-43828?: Medium severity, with a CVSS score of 4, published 25 May 2026.
Which products and versions are affected?: org.apache.shiro:shiro-web (Maven) ECOSYSTEM:introduced=1.0.0-incubating,fixed=2.2.0.
Is there a fix for CVE-2026-43828?: Yes. org.apache.shiro:shiro-web (Maven): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43828 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-43828?: Check whether you run org.apache.shiro:shiro-web (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.shiro:shiro-web (Maven): upgrade to 2.2.0 or later

# set org.apache.shiro:shiro-web to 2.2.0 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Apache Shiro's native session manager and Remember-Me manager (CWE-614). In default configurations, the framework fails to apply the 'Secure' attribute to JSESSIONID and rememberMe cookies during HTTPS sessions. This allows the cookies to be transmitted over unencrypted HTTP if a user is downgraded or redirected, enabling man-in-the-middle (MITM) attackers to capture session tokens. The issue is resolved in versions 2.1.1 (and 2.2.0) and 3.0.0-alpha-2 by ensuring the secure attribute is set by default.

Affected products

Apache Shiro 1.0 to 2.1.0, 3.0.0-alpha-1

Identifiers

CVE-2026-43828
GHSA-c6r4-qjmw-cvj2

Timeline

2026-05-25: advisory: Initial disclosure by Apache Software Foundation
2026-05-26: disclosed: Published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.