CVE-2026-58301 Apache Shiro: Server-side POST request may be steered to an alternate host

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

CVE-2026-58301

CVE-2026-58301 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro versions 2.x through 3.0.0 , specifically affecting deployments that use the Jakarta EE integration module . A low-privileged user can craft an HTTP request that causes the server to initiate a connection to an a...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

Linux Distros Unpatched Vulnerability : CVE-2026-58301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connectio...

CVE-2026-58301

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...

Security Bulletin: Security Vulnerability in Apache Shiro affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-43828)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Shiro Vulnerability Details CVEID:CVE-2026-43828 DESCRIPTION: Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects...

Security Bulletin: Security Vulnerability in Apache Shiro affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-49268)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed a vulnerability caused by Apache Shiro. Vulnerability Details CVEID:CVE-2026-49268 DESCRIPTION: A remote attacker can inject LDAP special characters into the Distinguished Name DN construction in DefaultLdapRealm...

Security Bulletin: Security Vulnerability in Apache Shiro affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-23901, CVE-2026-23903)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Shiro Vulnerability Details CVEID:CVE-2026-23903 DESCRIPTION: Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users ar...

CVE-2026-56130

A flaw was found in Apache Shiro. When the 'Remember me' functionality is enabled, the server does not verify the age of the 'Remember me' cookie. This allows a remote attacker to intercept a valid cookie and reuse it indefinitely, potentially leading to session hijacking. Mitigation Mitigation f...

Linux Distros Unpatched Vulnerability : CVE-2026-56130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Remember me cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the...

Linux Distros Unpatched Vulnerability : CVE-2026-56091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This...

CVE-2026-56130

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only whe...

DEBIAN-CVE-2026-56091

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...

DEBIAN-CVE-2026-56130

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only whe...

CVE-2026-56091

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...

UBUNTU-CVE-2026-56091

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...

CVE-2026-56091

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...

CVE-2026-56091

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...

EUVD-2026-39230

When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may cause an authentication bypass. This vulnerability is similar to https://vulners.com/cve/CVE-2020-1957 https://www.cve.org/CVERecord , except that it affects the shiro-guice module...

CVE-2026-56091

CVE-2026-56091 involves Apache Shiro when used with the shiro-guice module in a web servlet context. A specially crafted HTTP request may cause an authentication bypass. Affected: all Apache Shiro versions through 2.x; 3.0.0-alpha-1 is affected when using shiro-guice in this context. Remediation:...