Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:L/U:AmberSummary
CVE-2026-43827 is a medium-severity Session Fixation (CWE-384) vulnerability in Apache Shiro. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-12 (Session Termination) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31736
Vulnerability Data
Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected…
more
versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Session fixation directly enables use of a known web session cookie for unauthorized access (T1550.004) and facilitates browser session hijacking after victim login (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Forces automatic termination (and regeneration) of the existing session upon successful authentication, directly blocking the session-fixation condition described in the CVE.
Requires protection of session authenticity, which includes ensuring a fresh session identifier is issued after login rather than reusing an attacker-supplied one.
Enforces access-control decisions only after proper session establishment, preventing authorization from being granted on a pre-existing attacker-controlled session.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper authentication processes must invalidate prior session identifiers to prevent fixation attacks.
Managing identities and credentials includes handling session identifiers as temporary credentials that must be invalidated on re-authentication.
Protecting and verifying identity assertions encompasses secure handling and regeneration of session tokens.
Configuration baselines can enforce session regeneration and timeout settings that block fixation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect session-fixation issues, yet the weakness absence does not replace comprehensive testing.
Access-control policy can mandate session invalidation on re-authentication, but does not prescribe the technical mechanism.
Identity-management procedures can require new session tokens after login, yet the control is broader than session handling.
Authentication-information rules can include session-token lifecycle requirements, but the control focuses on credential management.
Secure-SDLC requirement can embed session-fixation checks, but eliminating the weakness does not satisfy the full SDLC control.
Application-security requirements can specify session handling, yet the weakness fix alone does not meet the broader requirement.