Raw vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:D/RE:L/U:GreenCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-56130 is a low-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Apache Shiro (inferred from references). Its CVSS base score is 2.0 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-39229
Vulnerability Data
"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from…
more
1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled. Upgrade to version 3.0.0 or later, which fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.16V10.5.1
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Session authenticity mechanisms directly stop replay of captured authentication traffic by enforcing freshness or cryptographic binding.
Transmission integrity (with anti-replay) stops captured messages from being accepted as valid later.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Cryptographic protections (e.g., nonces, timestamps, message authentication codes) make captured authentication messages unusable for replay.
A.8.28's secure design/architecture and threat modelling guidance (planning item g) and its prohibition on insecure design techniques can catch capture-replay during design, but the clause mandates a fallible practice whose effect depends on developer rigour, so only a minority of instances are prevented.
A.8.5 addresses several vectors relevant to capture-replay: item (j) bars cleartext password transmission, items (k) and (l) shorten the window via session termination and connection-duration limits, and the strong-authentication and MFA guidance (certificates, smart cards, tokens) typically carries replay protection as part of those mechanisms. But the clause does not mandate anti-replay primitives (nonces, timestamps, challenge-response) at the protocol level, and for non-critical systems password-only authentication remains acceptable, so a system compliant with A.8.5 can still be vulnerable to capture-replay — the remainder is nameable and not bounded to a vanishing slice.
A.8.8's reach is DISCLOSURE-based, and CWE-294 does surface as CVEs (observed examples include CVE-2005-3435 and CVE-2007-4961), so vulnerability scanning, advisory tracking, and external reports will surface some instances; the disclosed share of any weakness class is a minority, capping the rung at `partial`.