CVE-2026-48589
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Jakarta EE module in Apache Shiro (versions 2.0-alpha to 2.2.0 and 3.0.0-alpha-1) uses the HTTP Referer header for redirect after login. Insufficient validation of this client-controlled header could allow an attacker to influence the redirect target.
Risk Assessment
Risk of open redirect after login, potentially leading to data theft or phishing attacks.
Recommendation
Update Apache Shiro to version 2.2.1 or later (or 3.0.0-alpha-2). If updating is not possible, disable the shiro-jakarta-ee module or implement custom Referer header validation.
Other vulnerabilities in Apache Shiro
See all- CVE-2016-6802High
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
- CVE-2014-0074High
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty username or password.
- CVE-2026-49268Critical
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping, allowing manipulation of the DN structure used for LDAP bind authentication.
- CVE-2023-34478Critical
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
- CVE-2026-44598Medium
Apache Shiro versions 2.0-alpha to 2.1.0 and 3.0.0-alpha-1, when using the shiro-jakarta-ee module, are vulnerable to Open Redirect and SSRF. After login, the shiroSavedRequest cookie was not validated, allowing redirect to arbitrary URLs and server-side GET requests.
- CVE-2026-43828Medium
Default configurations of Apache Shiro send sensitive cookies (JSESSIONID and rememberMe) in HTTPS sessions without the 'Secure' attribute. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. Fixed in 2.1.1 and 3.0.0-alpha-2.
- CVE-2026-43827Medium
Default configurations of Apache Shiro have a session fixation vulnerability. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. In affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session generated with a new ID. Users are recommended to upgrade to version 2.1.1 or 3.0.0-alpha-2.
- CVE-2026-23903Medium
Vulnerability in Apache Shiro allows authentication bypass by varying the case of filenames in requests for static files. If static files are served from a case-insensitive filesystem (e.g., default macOS), an attacker can access files not covered by Shiro filters. Affects versions before 2.0.7.
Original NVD description (English source)
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.