CVE-2026-43827: Apache Shiro: Session fixation: new session is not created after login by default

[Lenny Primak <lprimak () apache org>]

Severity: 

Affected versions:

- Apache Shiro (org.apache.shiro:shiro-core) 1.0 through 2.1.0
- Apache Shiro (org.apache.shiro:shiro-core) 3.0.0-alpha-0 through 3.0.0-alpha-1

Description:

Default configurations of Apache Shiro have a session fixation vulnerability.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new 
session being generated with a new ID.

Credit:

Rasmus Moorats <xx () nns ee> (finder)
Lenny Primak <lenny () flowlogix com> (remediation developer)

References:

https://shiro.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-43827