# CVE-2026-74762: Apache Shiro: Possible session fixation with RememberMe

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/702) · 2026-11-14 · Security
Page: https://themorning.dev/story/cve-2026-74762-apache-shiro-possible-session-fixation-with-rememberme-1a5f930b0c3cc62a
Kind: security · Impact: medium

## In brief

- CVE-2026-74762 is a possible session fixation issue in Apache Shiro's RememberMe feature.
- The source rates it CVSS 4.0 5.9 (medium).
- The source lists org.apache.shiro:shiro-core before 3.0.1 as affected.

## Why it matters

Developers running affected Apache Shiro versions with RememberMe should check their dependency versions and upgrade to a fixed release.

## What to do

- Upgrade org.apache.shiro:shiro-core to 3.0.1 or later
- Check whether shiro-web is affected using the version list in the advisory

## Versions

- Apache Shiro 3.0.1

## CVEs

- CVE-2026-74762

## Timeline

- 2026-11-13: CVE-2026-74762 posted to oss-sec by Lenny Primak

## Coverage

- [CVE-2026-74762: Apache Shiro: Possible session fixation with RememberMe](https://seclists.org/oss-sec/2026/q4/702) — Open Source Security, 2026-11-14

Tags: apache-shiro, session-fixation, rememberme, vulnerability, java, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev