UNKNOWN Maven
Apache Shiro's "remember me" cookie age is not verified on the server.
GHSA-m8g6-vrr2-x7ff · CVE-2026-56130
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed.
This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.
Upgrade to version 3.0.0 or later, which fixes the issue.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56130
- WEB https://github.com/github/advisory-database/pull/10074
- WEB https://github.com/apache/shiro/commit/e441ea37009a426b122c53b0120ae5879d00e354
- PACKAGE https://github.com/apache/shiro
- WEB https://lists.apache.org/thread/9k9b3bmlq516ylvf7cdp3dlrtdtmxbmo
- WEB http://www.openwall.com/lists/oss-security/2026/06/24/8
Ready to move
Start Securing
Free, no credit card | First findings in minutes