CVE-2016-4437

Apache Shiro's 'remember me' feature has a critical flaw: when no encryption key is set, attackers can forge login tokens to bypass authentication or run malicious code on the server. This is dangerous because the feature is commonly used and the default configuration leaves systems vulnerable.

CVE-2016-4437 exploits improper cryptographic key management in Apache Shiro's RememberMe functionality (CWE-321). When no cipher key is configured, the serialized authentication token lacks encryption, allowing remote attackers to craft malicious serialized objects via request parameters that achieve arbitrary code execution through deserialization gadgets or direct authentication bypass. No authentication is required to trigger this vulnerability.