TI-2026-35945 Aliases CVE-2026-48589 GHSA-7pq2-fhx9-x464

Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow

LOW 3CWE-601Published 2026-05-25 · Updated 2026-05-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Spoofing
Confidentiality · integrity · availability: None · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00352 29th percentileScored 2026-11-07

Fix Partial org.apache.shiro:shiro-jakarta-ee (Maven): 2.2.1, 3.0.0-alpha-2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Shiro	2.0.0-alpha-0 – 2.2.0; 3.0.0-alpha-0 – 3.0.0-alpha-1	—	No fix listed	CNA
—	org.apache.shiro:shiro-jakarta-ee (Maven)	2.0-alpha to before 2.2.1	2.2.1	Patch available	GHSA-7pq2-fhx9-x464
—	org.apache.shiro:shiro-jakarta-ee (Maven)	3.0.0-alpha-0 to before 3.0.0-alpha-2	3.0.0-alpha-2	Patch available	GHSA-7pq2-fhx9-x464

Apache Shiro VendorApache Affected 2.0.0-alpha-0 – 2.2.0; 3.0.0-alpha-0 – 3.0.0-alpha-1 Fixed in — No fix listed CNA
org.apache.shiro:shiro-jakarta-ee (Maven) Vendor— Affected 2.0-alpha to before 2.2.1 Fixed in 2.2.1 Patch available GHSA-7pq2-fhx9-x464
org.apache.shiro:shiro-jakarta-ee (Maven) Vendor— Affected 3.0.0-alpha-0 to before 3.0.0-alpha-2 Fixed in 3.0.0-alpha-2 Patch available GHSA-7pq2-fhx9-x464

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:shiro::::::::	2.0.0 to before 2.2.1	Vulnerable	Apache
cpe:2.3:a:apache:shiro:3.0.0:alpha1::::::	3.0.0 alpha1	Vulnerable	Apache

cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.2.1 Vulnerable ·Apache
cpe:2.3:a:apache:shiro:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·Apache

Remediation

Fix · GHSA-7pq2-fhx9-x464 org.apache.shiro:shiro-jakarta-ee (Maven) Fixed in 2.2.1 Advisory →
Fix · GHSA-7pq2-fhx9-x464 org.apache.shiro:shiro-jakarta-ee (Maven) Fixed in 3.0.0-alpha-2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-05-25
Apache Shiro — shiro.apache.org/security-reports.html
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-31916 Apache Shiro: Session fixation: new session is not created after login by defaultPriority LOW 27
- TI-2026-31917 Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by defaultPriority LOW 26
Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-48589
2026-10-03 Alias added: GHSA-7pq2-fhx9-x464

References

Advisory 3

Other 1

https://github.com/apache/shiro

TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
TI-2020-13272 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
TI-2021-18132 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
TI-2022-14167 Authentication bypass in Apache Shiro CVSS 3.1CRITICAL 9.8
TI-2020-09649 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
TI-2020-10910 Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. CVSS 3.1HIGH 7.5

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences