A vulnerability classified as critical has been found in perfree go-fastdfs-web up to 1.3.7. This affects the function
.
rememberMeManager of the file src/main/java/com/perfree/config/ShiroConfig.java of the component Apache Shiro RememberMe. Performing a manipulation results in use of hard-coded cryptographic key.
This vulnerability is identified as CVE-2026-3963. The attack can be initiated remotely. Additionally, an exploit exists.
The vendor was contacted early about this disclosure but did not respond in any way.
