{
  "from_raw": "Lenny Primak <lprimak@apache.org>",
  "from": "Lenny Primak <lp...@apache.org>",
  "gravatar": "3412c78813a07ca863c82de7fc207fd7",
  "to": "an...@apache.org,\n de...@shiro.apache.org",
  "subject": "CVE-2026-43827: Apache Shiro: Session fixation: new session is not created after login by default",
  "message-id": "<8fe18db0-cf05-a730-9bc5-b077e90a3e28@apache.org>",
  "mid": "wmf4nmkmjqv2c1b6t441398crjwv4zlf",
  "permalinks": [
    "wmf4nmkmjqv2c1b6t441398crjwv4zlf",
    "r604bbab443509e1b47ccf9f5a176f72719953883a4d14ca651a17290@<announce.apache.org>"
  ],
  "dbid": "a505c836f1f3d22e7216d5e3450c835b47f0ac8cac856a820a88c3a8bc436978",
  "cc": "de...@shiro.apache.org",
  "epoch": 1779738613,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/05/25 19:50:13",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: \n\nAffected versions:\n\n- Apache Shiro (org.apache.shiro:shiro-core) 1.0 through 2.1.0\n- Apache Shiro (org.apache.shiro:shiro-core) 3.0.0-alpha-0 through 3.0.0-alpha-1\n\nDescription:\n\nDefault configurations of Apache Shiro have a session fixation vulnerability.\n\nThis issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.\n\nUsers are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.\n\nIn the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.\n\nCredit:\n\nRasmus Moorats <xx...@nns.ee> (finder)\nLenny Primak <le...@flowlogix.com> (remediation developer)\n\nReferences:\n\nhttps://shiro.apache.org/\nhttps://www.cve.org/CVERecord?id=CVE-2026-43827\n\n",
  "body_short": "Severity: \n\nAffected versions:\n\n- Apache Shiro (org.apache.shiro:shiro-core) 1.0 through 2.1.0\n- Apache Shiro (org.apache.shiro:shiro-core) 3.0.0-alpha-0 through 3.0.0-alpha-1\n\nDescription:\n\nDefault co",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 2756,
  "id": "wmf4nmkmjqv2c1b6t441398crjwv4zlf"
}