Apache Shiro has a session fixation vulnerability

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2026-43827 · ADVISORY
• apache/shiro · PACKAGE
• shiro.apache.org/security-reports.html · WEB
• openwall.com/lists/oss-security/2026/05/25/6 · WEB

Lỗ hổng khác của org.apache.shiro:shiro-core

• CVE-2026-49268NGHIÊM TRỌNG 9.1A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied …
• CVE-2026-23901THẤP 2.5Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recomm…
• CVE-2023-46749TRUNG BÌNH 6.5Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when use…
• CVE-2022-40664NGHIÊM TRỌNG 9.8Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
• CVE-2022-32532NGHIÊM TRỌNG 9.8Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPat…