CVE-2026-48589
published 2026-05-25CVE-2026-48589: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.35%
27.5th percentile
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.
In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module.
This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | shiro | — | — |
| apache | shiro | >= 2.0.0 < 2.2.1 | 2.2.1 |
| apache_software_foundation | apache_shiro | 2.0.0-alpha-0 – 2.2.0 | — |
| apache_software_foundation | apache_shiro | 3.0.0-alpha-0 – 3.0.0-alpha-1 | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv4.00.0NONECVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:X/U:Green
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7pq2-fhx9-x464: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
ghsa_unreviewed·2026-05-26
CVE-2026-48589 [LOW] CWE-601 GHSA-7pq2-fhx9-x464: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.
In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module.
This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
GHSA
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
ghsa·2026-05-26
CVE-2026-48589 [LOW] CWE-601 Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.
In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module.
This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
CVEList
Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
cvelistv5·2026-05-25
CVE-2026-48589 [NONE] CWE-601 Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.
In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module.
This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Red Hat
apache-shiro: shiro-jakarta-ee: Apache Shiro Jakarta EE module: Open Redirect via insufficient HTTP Referer header validation
vendor_redhat·2026-05-25·CVSS 5.4
CVE-2026-48589 [MEDIUM] CWE-601 apache-shiro: shiro-jakarta-ee: Apache Shiro Jakarta EE module: Open Redirect via insufficient HTTP Referer header validation
apache-shiro: shiro-jakarta-ee: Apache Shiro Jakarta EE module: Open Redirect via insufficient HTTP Referer header validation
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.
In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module.
This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
A flaw was found in Apache Shiro's Jakarta EE module. Insufficient validation of the HTTP Referer header, a client-controlled value, could allow an attacker to influence the redirect target after a user login. This vulnerability can be exploited
No detection rules found.
No public exploits indexed.
2026-05-25
Published