CVE-2026-74762: Apache Shiro: Possible session fixation with RememberMe

The Brief

CVE-2026-74762 is a possible session fixation issue in Apache Shiro's RememberMe feature.
The source rates it CVSS 4.0 5.9 (medium).
The source lists org.apache.shiro:shiro-core before 3.0.1 as affected.

Why it matters

Developers running affected Apache Shiro versions with RememberMe should check their dependency versions and upgrade to a fixed release.

Who’s affected

Java teams using Apache Shiro shiro-core before 3.0.1

What to do

Upgrade org.apache.shiro:shiro-core to 3.0.1 or later
Check whether shiro-web is affected using the version list in the advisory

Apache Shiro 3.0.1
CVE-2026-74762
#apache-shiro
#session-fixation
#rememberme
#vulnerability
#java
#cve

Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 5.9 (medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber Affected versions: - Apache Shiro (org.apache.shiro:shiro-core) before 3.0.1 - Apache Shiro (org.apache.shiro:shiro-web)…

Read the full story at seclists.org ↗

Timeline

Nov 13
CVE-2026-74762 posted to oss-sec by Lenny Primak
Nov 14 · 5:06 AM
Open Source Security
CVE-2026-74762: Apache Shiro: Possible session fixation with RememberMe