CVE-2026-43828 Overview
CVE-2026-43828 affects Apache Shiro, a widely deployed Java security framework used for authentication, authorization, cryptography, and session management. The default configuration of Shiro transmits sensitive session cookies over HTTPS connections without setting the Secure cookie attribute. Both the JSESSIONID cookie issued by the Shiro-native session manager and the rememberMe cookie issued by the Remember-Me manager are affected. Because these cookies lack the Secure flag, browsers may transmit them over plaintext HTTP requests, exposing them to network attackers. The flaw is tracked under CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute.
Critical Impact
Session and persistent authentication cookies can leak over HTTP, enabling network attackers to hijack authenticated user sessions.
Affected Products
- Apache Shiro versions 1.0 through 2.1.0
- Apache Shiro 3.0.0-alpha-1
- Applications using Shiro-native session manager or Remember-Me manager with default cookie configuration
Discovery Timeline
- 2026-05-25 - CVE-2026-43828 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-43828
Vulnerability Analysis
Apache Shiro manages user sessions through two primary mechanisms relevant to this issue. The Shiro-native session manager issues a JSESSIONID cookie to track authenticated sessions. The Remember-Me manager issues a rememberMe cookie containing serialized, encrypted identity data so users remain authenticated across browser restarts. In affected versions, neither cookie carries the Secure attribute by default. The Secure attribute instructs browsers to send the cookie only over TLS-protected channels. Without it, any subsequent HTTP request to the same domain causes the browser to attach the cookie in cleartext.
Root Cause
The root cause is an insecure default configuration in Shiro's cookie builders. The framework does not set cookie.setSecure(true) for JSESSIONID or rememberMe cookies when initialized with defaults. Developers must explicitly enable the attribute, and many deployments inherit the insecure default. The issue is classified as CWE-614, Sensitive Cookie in HTTPS Session Without 'Secure' Attribute.
Attack Vector
Exploitation requires a network position that allows observation of victim HTTP traffic to the target domain. Common scenarios include shared Wi-Fi, compromised intermediate networks, or DNS-based redirection to attacker-controlled HTTP endpoints. An attacker induces the victim browser to issue any HTTP request to the application domain, for example by embedding an http:// image or link in another page. The browser attaches the unsecured JSESSIONID and rememberMe cookies in cleartext. The attacker captures the cookies and replays them to impersonate the victim. The rememberMe cookie is particularly impactful because it grants persistent authentication. Refer to the Apache Shiro Security Report for vendor details.
Detection Methods for CVE-2026-43828
Indicators of Compromise
- HTTP requests to the application domain that include JSESSIONID or rememberMe cookies in cleartext within network captures or proxy logs.
- Authenticated sessions originating from unexpected IP addresses or geolocations shortly after a user accesses the application from an untrusted network.
- Concurrent active sessions for a single user account across distinct client fingerprints.
Detection Strategies
- Inspect Set-Cookie response headers from the application and confirm whether JSESSIONID and rememberMe cookies include the Secure and HttpOnly attributes.
- Audit running Shiro versions across the estate and flag any instance between 1.0 and 2.1.0 or equal to 3.0.0-alpha-1.
- Correlate web access logs to identify the same session identifier used from multiple disparate source IPs.
Monitoring Recommendations
- Forward web server and reverse proxy logs to a central analytics platform and alert on session reuse across IP boundaries.
- Monitor for any HTTP (non-HTTPS) listeners on application hostnames that could trigger cookie leakage.
- Track failed and successful authentications tied to rememberMe cookie usage to identify suspicious persistent logins.
How to Mitigate CVE-2026-43828
Immediate Actions Required
- Upgrade Apache Shiro to version 2.1.1 or 3.0.0-alpha-2 or later, which set the Secure attribute on sensitive cookies by default.
- Force HTTPS for all application endpoints and enable HTTP Strict Transport Security (HSTS) to prevent browsers from issuing plaintext requests.
- Invalidate existing rememberMe and session cookies after upgrade to revoke any tokens that may have leaked.
Patch Information
The Apache Shiro project addresses CVE-2026-43828 in releases 2.1.1 and 3.0.0-alpha-2. These versions configure the Secure attribute on JSESSIONID and rememberMe cookies by default. Review the Apache Shiro Security Report and the OpenWall OSS Security discussion for upgrade notes.
Workarounds
- In shiro.ini or programmatic configuration, explicitly set securityManager.sessionManager.sessionIdCookie.secure = true and securityManager.rememberMeManager.cookie.secure = true.
- Terminate TLS at a reverse proxy that rewrites Set-Cookie headers to append the Secure attribute if upgrading is not immediately feasible.
- Disable the Remember-Me feature until the framework is upgraded if persistent cookies are not required.
# Configuration example - shiro.ini
[main]
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
sessionManager.sessionIdCookie.secure = true
sessionManager.sessionIdCookie.httpOnly = true
sessionManager.sessionIdCookie.name = JSESSIONID
rememberMeManager = org.apache.shiro.web.mgt.CookieRememberMeManager
rememberMeManager.cookie.secure = true
rememberMeManager.cookie.httpOnly = true
securityManager.sessionManager = $sessionManager
securityManager.rememberMeManager = $rememberMeManager
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
