Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache
    Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or
    3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it
    is not invalidated upon successful login, nor is a new session being generated with a new ID.
    (CVE-2026-43827)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache     Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or     3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it     is not invalidated upon successful login, nor is a new session being generated with a new ID.
    (CVE-2026-43827)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464991	Echo: org.apache.shiro:shiro-core: security update to 2.2.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464991	Echo: org.apache.shiro:shiro-core: security update to 2.2.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
444151	SCA: security update for org.apache.shiro:shiro-core (GHSA-fcvm-3cpj-f9qx)	Tenable Cloud Security	SCA Checks	Local	medium
444151	SCA: security update for org.apache.shiro:shiro-core (GHSA-fcvm-3cpj-f9qx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
316789	Linux Distros Unpatched Vulnerability : CVE-2026-43827	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-43827

medium

Tenable Plugins

medium

medium

medium

medium

medium