{
  "from_raw": "Lenny Primak <lprimak@apache.org>",
  "from": "Lenny Primak <lp...@apache.org>",
  "gravatar": "3412c78813a07ca863c82de7fc207fd7",
  "to": "an...@apache.org,\n de...@shiro.apache.org",
  "subject": "CVE-2026-56130: Apache Shiro: Remember-me cookie isn't checked for expiry on the server",
  "message-id": "<625ede0b-b54c-04df-35a6-d21a2aa895fd@apache.org>",
  "mid": "pd4htjrbomyvzthtv43l2z3m6f2qpvkz",
  "permalinks": [
    "pd4htjrbomyvzthtv43l2z3m6f2qpvkz",
    "r50465c407e46d6238a8aeef733e143b5895f8ec7eee652448ae7d99f@<announce.apache.org>"
  ],
  "dbid": "32baa4a15adf8e21b2de458e3f59481589f556d1a8474ac29c8c935ac2362ee4",
  "cc": "de...@shiro.apache.org",
  "epoch": 1782325611,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/06/24 18:26:51",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: \n\nAffected versions:\n\n- Apache Shiro (org.apache.shiro:shiro-web) 1.2.4 through 2.99.99\n- Apache Shiro (org.apache.shiro:shiro-web) 3.0.0-alpha-0 through 3.0.0-alpha-1\n\nDescription:\n\n\"Remember me\" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed.\nThis issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.\n\n\nUpgrade to version 3.0.0 or later, which fixes the issue.\n\nCredit:\n\nRichard Bradley (finder)\nLenny Primak <le...@flowlogix.com> (remediation developer)\n\nReferences:\n\nhttps://shiro.apache.org/\nhttps://www.cve.org/CVERecord?id=CVE-2026-56130\n\n",
  "body_short": "Severity: \n\nAffected versions:\n\n- Apache Shiro (org.apache.shiro:shiro-web) 1.2.4 through 2.99.99\n- Apache Shiro (org.apache.shiro:shiro-web) 3.0.0-alpha-0 through 3.0.0-alpha-1\n\nDescription:\n\n\"Remembe",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 2723,
  "id": "pd4htjrbomyvzthtv43l2z3m6f2qpvkz"
}