Skip to content
OpenAdvisories

Package · Maven

org.apache.shiro:shiro-web

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-43828

    Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default

    Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, whic…

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • Medium 4.7
    CVE-2023-46750

    Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven