CVE-2026-43828

The record

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

Affected packages

Related vulnerabilities

• CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy… CWE-614
• CVE-2026-46550 NocoDB is software for building databases as spreadsheets. CWE-614
• CVE-2026-53661 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid… CWE-614
• CVE-2026-11956 A vulnerability was determined in TwiN gatus 5.36.0. CWE-614
• CVE-2026-46398 HAX CMS helps manage microsite universe with PHP or NodeJs backends. CWE-614
• CVE-2025-52608 HCL iControl was affected by Missing Cookie Attributes vulnerability. CWE-614
• CVE-2026-41017 Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure`… CWE-614
• GHSA-f74w-272x-mqcv NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags CWE-614