CVE-2026-56130 Apache Shiro: Remember-me cookie isn't checked for expiry on the server

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.shiro:shiro-web",
    "product": "Apache Shiro",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.99.99",
        "status": "affected",
        "version": "1.2.4",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "3.0.0-alpha-1",
        "status": "affected",
        "version": "3.0.0-alpha-0",
        "versionType": "semver"
      }
    ]
  }
]