# CVE-2026-43828: Apache Shiro missing Secure attribute on sensitive cookies

Source: https://junglewise.ai/threats/cve-2026-43828-apache-shiro-missing-secure-attribute-on-sensitive-cookies  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-43828 · Severity: medium · CVSS 4 · Published 2026-05-25

Apache Shiro, a security framework for Java applications, fails to properly protect session cookies in its default configuration. This allows sensitive login and session information to be transmitted over unencrypted channels even when the website is using HTTPS. An attacker could potentially intercept these cookies to hijack a user's session and gain unauthorized access to their account.

Technologies: [org.apache.shiro:shiro-web (Maven)](https://junglewise.ai/threats/technologies/org-apache-shiro-shiro-web). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-43828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43828 being exploited in the wild.

**How severe is CVE-2026-43828?** Medium severity, with a CVSS score of 4, published 25 May 2026.

**Which products and versions are affected?** org.apache.shiro:shiro-web (Maven) ECOSYSTEM:introduced=1.0.0-incubating,fixed=2.2.0.

**Is there a fix for CVE-2026-43828?** Yes. org.apache.shiro:shiro-web (Maven): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43828 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-43828?** Check whether you run org.apache.shiro:shiro-web (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.shiro:shiro-web (Maven): upgrade to 2.2.0 or later

  ```sh
  # set org.apache.shiro:shiro-web to 2.2.0 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in Apache Shiro's native session manager and Remember-Me manager (CWE-614). In default configurations, the framework fails to apply the 'Secure' attribute to JSESSIONID and rememberMe cookies during HTTPS sessions. This allows the cookies to be transmitted over unencrypted HTTP if a user is downgraded or redirected, enabling man-in-the-middle (MITM) attackers to capture session tokens. The issue is resolved in versions 2.1.1 (and 2.2.0) and 3.0.0-alpha-2 by ensuring the secure attribute is set by default.

## Affected products

- Apache Shiro 1.0 to 2.1.0, 3.0.0-alpha-1

## Identifiers

- CVE-2026-43828
- GHSA-c6r4-qjmw-cvj2

## Timeline

- 2026-05-25: advisory: Initial disclosure by Apache Software Foundation
- 2026-05-26: disclosed: Published to GitHub Advisory Database

## References

- [https://shiro.apache.org/security-reports.html](https://shiro.apache.org/security-reports.html)
- [http://www.openwall.com/lists/oss-security/2026/05/25/7](http://www.openwall.com/lists/oss-security/2026/05/25/7)

## Related threats

- [Apache Shiro authentication bypass via RememberMe cookie replay](https://junglewise.ai/threats/cve-2026-56130-apache-shiro-authentication-bypass-via-rememberme-cookie-replay)
- [Open redirect in Apache Shiro](https://junglewise.ai/threats/cve-2023-46750-open-redirect-in-apache-shiro)
- [Path Traversal in Apache Shiro](https://junglewise.ai/threats/cve-2023-34478-path-traversal-in-apache-shiro)
- [Improper Access Control in Apache Shiro](https://junglewise.ai/threats/cve-2016-6802-improper-access-control-in-apache-shiro)
- [Authentication bypass in Apache Shiro](https://junglewise.ai/threats/cve-2020-17523-authentication-bypass-in-apache-shiro)