This vulnerability (CVE-2026-43828) affects Apache Shiro's default configuration in versions 1.0 to 2.1.0 and 3.0.0-alpha-1, where the Shiro-native session manager and Remember-Me manager send sensitive cookies (JSESSIONID and rememberMe) without the 'Secure' attribute in HTTPS sessions. The absence of the 'Secure' attribute means these cookies might be transmitted over unencrypted HTTP connections if the application is not properly configured, potentially exposing session information. The issue is resolved by upgrading to Apache Shiro version 2.1.1 or 3.0.0-alpha-2 or later.

Sensitive session cookies lacking the 'Secure' attribute may be transmitted over unencrypted channels if the application is misconfigured, increasing the risk of session hijacking or interception. However, this vulnerability requires user interaction and network conditions that allow interception. No known exploits are reported in the wild.

Users should upgrade Apache Shiro to version 2.1.1 or 3.0.0-alpha-2 or later where this issue is fixed. Since no official patch link or advisory is provided, verify the upgrade path with Apache Software Foundation's official releases. Until upgraded, ensure application configurations enforce HTTPS and consider manually setting the 'Secure' attribute on cookies if possible. Patch status is not explicitly confirmed beyond upgrade recommendations; check the vendor advisory for the latest remediation guidance.