Executive brief
Apache Shiro, a security framework for Java applications, fails to properly protect session cookies in its default configuration. This allows sensitive login and session information to be transmitted over unencrypted channels even when the website is using HTTPS. An attacker could potentially intercept these cookies to hijack a user's session and gain unauthorized access to their account.
Technical details
A vulnerability exists in Apache Shiro's native session manager and Remember-Me manager (CWE-614). In default configurations, the framework fails to apply the 'Secure' attribute to JSESSIONID and rememberMe cookies during HTTPS sessions. This allows the cookies to be transmitted over unencrypted HTTP if a user is downgraded or redirected, enabling man-in-the-middle (MITM) attackers to capture session tokens. The issue is resolved in versions 2.1.1 (and 2.2.0) and 3.0.0-alpha-2 by ensuring the secure attribute is set by default.
Affected products
- Apache Shiro 1.0 to 2.1.0, 3.0.0-alpha-1
Timeline
- 2026-05-25: advisory: Initial disclosure by Apache Software Foundation
- 2026-05-26: disclosed: Published to GitHub Advisory Database