Vulnerability GHSA-fcvm-3cpj-f9qx
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
5 months ago
May 26, 2026 at 01:30 PM UTC
Apache Shiro has a session fixation vulnerability
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1
Summary
Apache Shiro has a session fixation vulnerability
Details
Default configurations of Apache Shiro have a session fixation vulnerability.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.
In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
4 months ago
Apache Shiro's "remember me" cookie age is not verified on the server.
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
High Risk
4 months ago
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
1.0.0-incubating - 2.2.0 and 3.0.0-alpha-1 GHSA-x96m-rh44-vgv8
1.0.0-incubating - 2.2.0 and 3.0.0-alpha-1 GHSA-x96m-rh44-vgv8
Low Risk
8 months ago
Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability
1.0.0-incubating - 2.0.6 GHSA-c4qc-4q9p-m9q9
1.0.0-incubating - 2.0.6 GHSA-c4qc-4q9p-m9q9
Medium Risk
2 years ago
Apache Shiro vulnerable to path traversal
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-jc7h-c423-mpjc
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-jc7h-c423-mpjc
Critical
4 years ago
Apache Shiro Authentication Bypass vulnerability
1.0.0-incubating - 1.9.1 GHSA-45x9-q6vj-cqgq
1.0.0-incubating - 1.9.1 GHSA-45x9-q6vj-cqgq
Impacted packages
Timeline
Published
5 months ago
May 26, 2026 at 01:30 PM UTC
Fixed (2.2.0)
Unknown
Unknown
Last Modified
4 months ago
June 30, 2026 at 05:41 PM UTC