GitHub Advisoryadvisory · Maven

GHSA-7pq2-fhx9-x464 Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login

LOW Published 2026-05-26 Modified 2026-07-10 Official page ↗
Aliases
CVE-2026-48589
Ecosystem
Maven
Packages
org.apache.shiro:shiro-jakarta-ee
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-07-10

Affected packages

• Maven org.apache.shiro:shiro-jakarta-ee: >= 2.0-alpha, < 2.2.1 → fixed in 2.2.1 • Maven org.apache.shiro:shiro-jakarta-ee: >= 3.0.0-alpha-0, < 3.0.0-alpha-2 → fixed in 3.0.0-alpha-2

Description

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.

Related

Alias · CVE (1)

  • CVE-2026-48589 Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References