# CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/700) · 2026-11-14 · Security
Page: https://themorning.dev/story/cve-2026-88019-apache-shiro-saved-form-replay-may-weaken-cookie-security-and-exp-6e74624db7b23867
Kind: security · Impact: medium

## In brief

- Apache Shiro advisory CVE-2026-88019 covers saved form replay that may weaken cookie security and expose form data.
- Affected: org.apache.shiro:shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2.
- The advisory rates it CVSS 4.0 6.0 (medium).

## Why it matters

Applications on affected shiro-jakarta-ee versions may have weakened cookie security and exposed form data until they upgrade to 3.0.2 or later.

## What to do

- Upgrade shiro-jakarta-ee to 3.0.2 or later

## Versions

- Apache Shiro 2.0.0-alpha-0
- Apache Shiro 3.0.2

## CVEs

- CVE-2026-88019

## Timeline

- 2026-11-13: Vulnerability posted to oss-security by Lenny Primak

## Coverage

- [CVE-2026-88019: Apache Shiro: Saved form replay may weaken cookie security and expose form data](https://seclists.org/oss-sec/2026/q4/700) — Open Source Security, 2026-11-14

Tags: security, apache-shiro, java, cookies, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev