Vulnerability · Published May 25, 2026 · Assigned by apache
CVE-2026-44598Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
Medium 5.1
In plain English
A medium-severity open redirect in Apache Shiro Jakarta EE module from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.shiro:shiro-jakarta-ee | 2.2.0 | GHSA-wpqm-4gwx-w843 |
| Maven | org.apache.shiro:shiro-jakarta-ee | 3.0.0-alpha-2 | GHSA-wpqm-4gwx-w843 |
| Ubuntu:22.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-44598 |
| Ubuntu:25.10 | shiro | no fix listed | UBUNTU-CVE-2026-44598 |
| Ubuntu:26.04:LTS | shiro | no fix listed | UBUNTU-CVE-2026-44598 |
| Ubuntu:26.10 | shiro | no fix listed | UBUNTU-CVE-2026-44598 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Shiro Jakarta EE module | 2.0.0-alpha-0 – through 2.1.03.0.0-alpha-0 – through 3.0.0-alpha-1 |
Weakness: CWE-601, CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:Y/R:A/V:D/RE:L/U:Green