CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data

The Brief

Apache Shiro advisory CVE-2026-88019 covers saved form replay that may weaken cookie security and expose form data.
Affected: org.apache.shiro:shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2.
The advisory rates it CVSS 4.0 6.0 (medium).

Why it matters

Applications on affected shiro-jakarta-ee versions may have weakened cookie security and exposed form data until they upgrade to 3.0.2 or later.

Who’s affected

Teams using org.apache.shiro:shiro-jakarta-ee 2.0.0-alpha-0 before 3.0.2

What to do

Upgrade shiro-jakarta-ee to 3.0.2 or later

Apache Shiro 2.0.0-alpha-0
Apache Shiro 3.0.2
CVE-2026-88019
#security
#apache-shiro
#java
#cookies
#cve

Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 6.0 (medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber Affected versions: - Apache Shiro (org.apache.shiro:shiro-jakarta-ee) 2.0.0-alpha-0 before 3.0.2 Description: When…

Read the full story at seclists.org ↗

Timeline

Nov 13
Vulnerability posted to oss-security by Lenny Primak
Nov 14 · 4:51 AM
Open Source Security
CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data