CVE-2026-56130
Apache Shiro: Remember-me cookie isn't checked for expiry on the server
Description
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled. Upgrade to version 3.0.0 or later, which fixes the issue.
INFO
Published Date :
June 25, 2026, 8:44 a.m.
Last Modified :
June 25, 2026, 8:44 a.m.
Remotely Exploit :
Yes !
Source :
apache
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | LOW | f0158376-9dc2-43b6-827c-5f631a4d8d09 | ||||
| CVSS 4.0 | LOW | [email protected] |
Solution
- Upgrade Apache Shiro to version 3.0.0 or later.
- Enable RememberMe functionality validation.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-56130 vulnerability anywhere in the article.