CVE-2026-43828: Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default

[Lenny Primak <lprimak () apache org>]

Severity: 

Affected versions:

- Apache Shiro (org.apache.shiro:shiro-web) 1.0 through 2.1.0
- Apache Shiro (org.apache.shiro:shiro-web) 3.0.0-alpha-0 through 3.0.0-alpha-1

Description:

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.



This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe 
cookies without 'secure' attribute by default.

Credit:

Meteor_Kai <1318723916 () qq com> (finder)
Lenny Primak <lenny () flowlogix com> (remediation developer)

References:

https://shiro.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-43828