CVE-2026-56130

Overview

Apache Shiro is an open-source Java security framework that performs authentication, authorization, cryptography, and session management for applications ranging from small mobile apps to large web and enterprise systems. Its shiro-web module integrates Shiro into servlet applications, where a cookie-based RememberMe service can recognize returning users across sessions without requiring them to log in again.

An authorization bypass vulnerability (CVE-2026-56130) has been identified in Apache Shiro, which allows attackers to replay a captured rememberMe cookie and be accepted as the remembered user long after the cookie's configured lifetime has expired. Because the server never checks the cookie's age, a stolen cookie remains usable until the application's rememberMe cipher key changes.

Per CWE-294: a capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

This issue affects Apache Shiro versions 1.2.4 through 2.x, as well as the 3.0.0-alpha-1 pre-release, only when the RememberMe functionality is enabled.

Details

Module Info

• Product: Apache Shiro
• Affected packages: org.apache.shiro:shiro-core, org.apache.shiro:shiro-web
• Affected versions: >=1.2.4 <3.0.0
• GitHub repository: https://github.com/apache/shiro
• Published packages: https://central.sonatype.com/artifact/org.apache.shiro/shiro-core, https://central.sonatype.com/artifact/org.apache.shiro/shiro-web
• Package manager: Maven
• Fixed in: NES for Apache Shiro 1.8.0-shiro-1.8.2 and 1.13.0-shiro-1.13.2

Vulnerability Info

This Low-severity vulnerability is found in the org.apache.shiro:shiro-core and org.apache.shiro:shiro-web packages in Apache Shiro versions 1.2.4 through 2.x and the 3.0.0-alpha-1 pre-release. When a user logs in with the RememberMe option, Shiro serializes the user's identity, encrypts it with the application's rememberMe cipher key, and stores it in a rememberMe cookie whose default lifetime is one year (Cookie.ONE_YEAR). The CookieRememberMeManager that issues and reads this cookie is installed by default by DefaultWebSecurityManager, so the feature is active in any Shiro web application that performs RememberMe logins.

The serialized payload carries no creation timestamp, and the server never verifies the cookie's age. On the write path the identity is serialized as-is (byte[] bytes = serialize(principals);), and on the read path in AbstractRememberMeManager the cookie is simply decrypted and deserialized, with no expiry check anywhere:

protected PrincipalCollection convertBytesToPrincipals(byte[] bytes, SubjectContext subjectContext) {
    if (getCipherService() != null) {
        bytes = decrypt(bytes);
    }
    return deserialize(bytes);
}

The configured cookie maxAge is therefore enforced only by the victim's browser. An attacker who captures a valid rememberMe cookie, through network interception, device theft, or leaked logs, can replay it in a crafted request and be accepted as the remembered user indefinitely, long after the cookie was supposed to expire; the replayed cookie stays valid until the application's cipher key changes. Because the payload is encrypted with the application's key, an attacker cannot mint new cookies, so the issue is strictly the unlimited replay lifetime of a captured cookie. Every release from 1.2.4 through 2.x therefore accepts remembered identities regardless of age.

Mitigation

Apache Shiro 1.x is End-of-Life and no longer receives open-source updates to address this issue. The final 1.x release was 1.13.0; as of February 28, 2024, Shiro v1 was superseded by v2. The 1.x and 2.x lines have no publicly available fix for this issue; the server-side expiry check first shipped in Apache Shiro 3.0.0.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Shiro to a currently supported release line that contains the fix, first shipped upstream in Apache Shiro 3.0.0.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Richard Bradley (finder)