VulnSocial

CVE-2026-56130Disclosure

LOWCVSS 2.0 · LOW

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled. Upgrade to version 3.0.0 or later, which fixes the issue.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-294

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-06-25: 3Technical Details · 2026-06-25: 306-25
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2026-56091: Apache Shiro: Authentication bypass in Guice-Web integration https://www.openwall.com/lists/oss-security/2026/06/24/7 CVE-2026-56130: Apache Shiro: Remember-me cookie isn't checked for expiry on the server https://www.openwall.com/lists/oss-security/2026/06/24/8

    Post summary

    Two new Apache Shiro vulnerabilities have been disclosed: one enables authentication bypass in the Guice-Web integration, the other allows attackers to bypass cookie expiry checks on remember-me tokens. No PoC, exploit code, patch, or evidence of active exploitation is provided.

    00010176
    4.6K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-56130 "Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the conf… https://www.cve.org/CVERecord?id=CVE-2026-56130 ----- Traducción: CVE-2026-56130 "Re… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-56130, noting that a 'Remember me' cookie’s age isn’t verified, which could let attackers reuse valid cookies indefinitely.

    0000024
    89 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-56130 "Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the conf… https://www.cve.org/CVERecord?id=CVE-2026-56130

    Post summary

    The post announces CVE-2026-56130, describing a cookie age verification flaw that could enable indefinite cookie reuse, but provides no PoC, patch, or evidence of active exploitation.

    00000817
    57.7K followersView on X

Explore more

Back to dashboard