Is CVE-2026-56130 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56130 being exploited in the wild.

How severe is CVE-2026-56130?

Medium severity, with a CVSS score of 4, published 25 June 2026.

Which products and versions are affected?

org.apache.shiro:shiro-core (Maven) >= 1.2.4, = 1.2.4, < 3.0.0, ECOSYSTEM:introduced=1.2.4,fixed=3.0.0.

Is there a fix for CVE-2026-56130?

Yes. org.apache.shiro:shiro-core (Maven): upgrade to 3.0.0 or later; org.apache.shiro:shiro-web (Maven): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56130 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56130?

Check whether you run org.apache.shiro:shiro-core (Maven) or org.apache.shiro:shiro-web (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56130: Apache Shiro authentication bypass via RememberMe cookie replay

Q: Is there a fix for CVE-2026-56130?

Yes. org.apache.shiro:shiro-core (Maven): upgrade to 3.0.0 or later; org.apache.shiro:shiro-web (Maven): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56130 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56130?

Check whether you run org.apache.shiro:shiro-core (Maven) or org.apache.shiro:shiro-web (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56130 · Severity: medium · CVSS 4 · Published 2026-06-25

Apache Shiro, a security framework for Java applications, contains a flaw in its 'Remember Me' login feature. An attacker who intercepts a user's login cookie can reuse it to gain access to the application indefinitely, even after the cookie was supposed to expire. This could lead to unauthorized account access if a user's session information is compromised.

Technologies: org.apache.shiro:shiro-core (Maven), org.apache.shiro:shiro-web (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-56130 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56130 being exploited in the wild.
How severe is CVE-2026-56130?: Medium severity, with a CVSS score of 4, published 25 June 2026.
Which products and versions are affected?: org.apache.shiro:shiro-core (Maven) >= 1.2.4, < 3.0.0, ECOSYSTEM:introduced=1.2.4,fixed=3.0.0; org.apache.shiro:shiro-web (Maven) >= 1.2.4, < 3.0.0, ECOSYSTEM:introduced=1.2.4,fixed=3.0.0.
Is there a fix for CVE-2026-56130?: Yes. org.apache.shiro:shiro-core (Maven): upgrade to 3.0.0 or later; org.apache.shiro:shiro-web (Maven): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56130 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56130?: Check whether you run org.apache.shiro:shiro-core (Maven) or org.apache.shiro:shiro-web (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.shiro:shiro-core (Maven): upgrade to 3.0.0 or later

# set org.apache.shiro:shiro-core to 3.0.0 in your pom.xml or build.gradle

org.apache.shiro:shiro-web (Maven): upgrade to 3.0.0 or later

# set org.apache.shiro:shiro-web to 3.0.0 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Apache Shiro's RememberMe functionality where the server fails to validate the age of the 'Remember Me' cookie. This is classified as an authentication bypass by capture-replay (CWE-294). An attacker who successfully intercepts a valid 'Remember Me' cookie can replay it to the server to maintain an authenticated session indefinitely, bypassing configured expiration policies. The issue affects versions 1.2.4 through 2.x and 3.0.0-alpha-1. Users are advised to upgrade to version 3.0.0 or later to ensure server-side age verification is enforced.

Affected products

Apache Shiro 1.2.4 through 2.x, 3.0.0-alpha-1

Identifiers

CVE-2026-56130
GHSA-m8g6-vrr2-x7ff

Timeline

2026-06-25: disclosed
2026-06-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.