Vulnerability · Published May 25, 2026 · Assigned by apache
CVE-2026-48589Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow
None 0.0
In plain English
A open redirect in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.shiro:shiro-jakarta-ee | 2.2.1 | GHSA-7pq2-fhx9-x464 |
| Maven | org.apache.shiro:shiro-jakarta-ee | 3.0.0-alpha-2 | GHSA-7pq2-fhx9-x464 |
| Ubuntu:22.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-48589 |
| Ubuntu:25.10 | shiro | no fix listed | UBUNTU-CVE-2026-48589 |
| Ubuntu:26.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-48589 |
| Ubuntu:26.10 | shiro | no fix listed | UBUNTU-CVE-2026-48589 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Shiro | 2.0.0-alpha-0 – through 2.2.03.0.0-alpha-0 – through 3.0.0-alpha-1 |
Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:D/U:Green