Riskcovery

CVE-2026-48589

Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow

State
Published
Severity
0.0 None
Published
May 25, 2026
Updated
May 26, 2026
Reserved
May 22, 2026

Read the record on cve.org

Description

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.

Scores

CVSSScoreVectorSource
4.00.0 NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:D/U:Greenapache

Weaknesses

  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

ProductVersions
Apache ShiroApache Software Foundation
  • 2.0.0-alpha-0 through 2.2.0Affected
  • 3.0.0-alpha-0 through 3.0.0-alpha-1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.