CVE-2026-48589

published 2026-05-25

CVE-2026-48589: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient…

low 0 CVSS 4.0

AV N AC L AT N PR L UI A VC N VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S N AU Y R A V D RE X U Green

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.
In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module.
This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
apache	shiro	—	—
apache	shiro	>= 2.0.0 < 2.2.1	2.2.1
apache_software_foundation	apache_shiro	2.0.0-alpha-0 – 2.2.0	—
apache_software_foundation	apache_shiro	3.0.0-alpha-0 – 3.0.0-alpha-1	—

CWE-601