CVE-2016-4437

It was found that Apache Shiro uses a default cipher key for its “remember me” feature. An attacker could use this to devise a malicious request parameter and gain access to unauthorized content.