CVE-2026-56130: Apache Shiro Auth Bypass Vulnerability

CVE-2026-56130 Overview

CVE-2026-56130 affects Apache Shiro, a Java security framework widely used for authentication, authorization, and session management. The vulnerability stems from the server failing to verify the age of the RememberMe cookie. An attacker who intercepts a valid RememberMe cookie can reuse it indefinitely, even after the configured expiration time has elapsed. The flaw is categorized under [CWE-294]: Authentication Bypass by Capture-replay. It impacts Apache Shiro versions 1.2.4 through 2.x, and 3.0.0-alpha-1, but only when the RememberMe functionality is enabled. Apache has addressed the issue in version 3.0.0.

Critical Impact
An attacker who captures a RememberMe cookie can authenticate as the victim indefinitely, bypassing the configured cookie expiration policy.

Affected Products

Apache Shiro 1.2.4 through 1.x (with RememberMe enabled)
Apache Shiro 2.x (with RememberMe enabled)
Apache Shiro 3.0.0-alpha-1

Discovery Timeline

2026-06-25 - CVE-2026-56130 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56130

Vulnerability Analysis

Apache Shiro's RememberMe feature persists authentication state across browser sessions using an encrypted cookie. When a user returns to an application, Shiro decrypts the cookie and rehydrates the principal, allowing access without a fresh login. The expected behavior is that the cookie is honored only within the configured maximum age window. In affected versions, the server-side logic decrypts and trusts the cookie without validating an issuance or expiration timestamp embedded in the token. Browser-side Max-Age and Expires attributes are advisory and cannot be relied on as a security boundary. Any attacker who obtains a valid cookie value can submit it back to the server long after the intended expiration and receive an authenticated session.

Root Cause

The root cause is a missing server-side expiration check on the RememberMe token. Shiro relies on the browser to discard the cookie after its Max-Age elapses rather than embedding and validating a server-verified timestamp inside the serialized identity payload. This violates the principle that authentication tokens must carry verifiable lifetime metadata.

Attack Vector

Exploitation requires an attacker to first obtain a valid RememberMe cookie. Capture paths include cross-site scripting, malicious browser extensions, theft from disk, network interception against misconfigured TLS deployments, or compromise of intermediaries that log cookies. Once captured, the attacker replays the cookie against the target application. The server decrypts the cookie, finds a valid principal, and grants an authenticated session regardless of how much time has passed since issuance.

No verified public exploit code is available. See the Apache Security Discussion Thread and the Openwall OSS-Security Update for vendor discussion.

Detection Methods for CVE-2026-56130

Indicators of Compromise

Authentication events where a session is established via a RememberMe cookie that should have expired based on the configured cookie.maxAge policy.
Repeated use of identical RememberMe cookie values from multiple distinct IP addresses, user agents, or geolocations.
Successful authentications without a preceding interactive login flow for accounts that have been inactive beyond the remember-me window.

Detection Strategies

Instrument Shiro's RememberMeManager to log the decrypted principal along with the request timestamp, then correlate against the user's last interactive login.
Alert on RememberMe-driven authentications occurring outside the configured retention window by comparing cookie creation telemetry to session establishment events.
Hunt for replay patterns where the same cookie ciphertext is presented from divergent client fingerprints over short time intervals.

Monitoring Recommendations

Forward web application access logs, Shiro authentication events, and reverse proxy logs to a centralized analytics platform for correlation.
Track the ratio of RememberMe logins to interactive logins per account and flag statistical anomalies.
Monitor for cookies presented after a server-side password change or session invalidation, which should be treated as suspicious replay attempts.

How to Mitigate CVE-2026-56130

Immediate Actions Required

Upgrade Apache Shiro to version 3.0.0 or later, which enforces server-side expiration on RememberMe cookies.
If immediate upgrade is not possible, disable the RememberMe feature in Shiro configuration until patching is complete.
Invalidate existing RememberMe cookies by rotating the RememberMe cipher key, which forces all outstanding tokens to fail decryption.
Require interactive re-authentication for sensitive operations regardless of RememberMe state.

Patch Information

Apache has released Apache Shiro 3.0.0, which adds server-side verification of the RememberMe cookie age. All deployments running 1.2.4 through 2.x or 3.0.0-alpha-1 with RememberMe enabled should upgrade. Refer to the Apache Security Discussion Thread for upgrade guidance.

Workarounds

Disable the RememberMe feature by setting securityManager.rememberMeManager to a null implementation or removing the cookie configuration.
Rotate the RememberMe cipher key on every deployment to invalidate previously issued tokens.
Shorten the configured cookie maxAge and enforce shorter session lifetimes server-side until the upgrade is applied.
Mark RememberMe cookies as Secure and HttpOnly and serve the application strictly over TLS to reduce capture risk.

bash

# Disable RememberMe in shiro.ini as a temporary workaround
[main]
rememberMeManager = org.apache.shiro.web.mgt.CookieRememberMeManager
rememberMeManager.cookie.maxAge = 0
securityManager.rememberMeManager = $rememberMeManager