CVE-2026-58301
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Upgrade to version 3.0.1 or later fixes the issue. Alternatively, set the org.apache.shiro.form-resubmit-host and org.apache.shiro.form-resubmit-port system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
Risk Assessment
An attacker can use the server to send data to external URLs, potentially leading to data leakage or use of the server as a tool for attacks. It requires low privileges but can be exploited remotely.
Recommendation
Upgrade Apache Shiro to version 3.0.1 or later. If upgrade is not possible, configure the system properties to restrict the host and port for form resubmission.
Other vulnerabilities in Apache Shiro
See all- CVE-2016-6802High
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
- CVE-2014-0074High
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty username or password.
- CVE-2026-49268Critical
A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping, allowing manipulation of the DN structure used for LDAP bind authentication.
- CVE-2023-34478Critical
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
- CVE-2026-48589Medium
The Jakarta EE module in Apache Shiro (versions 2.0-alpha to 2.2.0 and 3.0.0-alpha-1) uses the HTTP Referer header for redirect after login. Insufficient validation of this client-controlled header could allow an attacker to influence the redirect target.
- CVE-2026-44598Medium
Apache Shiro versions 2.0-alpha to 2.1.0 and 3.0.0-alpha-1, when using the shiro-jakarta-ee module, are vulnerable to Open Redirect and SSRF. After login, the shiroSavedRequest cookie was not validated, allowing redirect to arbitrary URLs and server-side GET requests.
- CVE-2026-43828Medium
Default configurations of Apache Shiro send sensitive cookies (JSESSIONID and rememberMe) in HTTPS sessions without the 'Secure' attribute. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. Fixed in 2.1.1 and 3.0.0-alpha-2.
- CVE-2026-43827Medium
Default configurations of Apache Shiro have a session fixation vulnerability. Affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1. In affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session generated with a new ID. Users are recommended to upgrade to version 2.1.1 or 3.0.0-alpha-2.
- CVE-2026-23903Medium
Vulnerability in Apache Shiro allows authentication bypass by varying the case of filenames in requests for static files. If static files are served from a case-insensitive filesystem (e.g., default macOS), an attacker can access files not covered by Shiro filters. Affects versions before 2.0.7.
Original NVD description (English source)
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. + Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.