Apache Shiro’s default configuration permits a session‑fixation attack because a new session is not created during login. If an existing session remains active after authentication, an attacker who can set or predict the session identifier before login can hijack that authenticated session. This flaw is classified as CWE‑384 and can compromise confidentiality, integrity, and availability of data accessed with the hijacked session.

Apache Shiro versions from 1.0 through 2.1.0 and the 3.0.0‑alpha‑1 release are affected. Users must upgrade to at least 2.1.1 or 3.0.0‑alpha‑2, which address the session‑fixation behavior.

The vulnerability carries a CVSS score of 5.9, indicating moderate severity, and is not currently listed in CISA’s KEV catalog. Although EPSS is not reported, the fix is straightforward and the risk remains significant when an attacker can influence session identifiers. The likely attack vector involves sending a crafted cookie or URL parameter that establishes a session before authentication, followed by a standard login to retain that session.