Vulnerabilities

TI-2026-35945 CVE-2026-48589 · GHSA-7pq2-fhx9-x464

Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow

LOW 3

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00352 Published 2026-05-25 Partial fix · 2.2.1, 3.0.0-alpha-2 CWE-601

TI-2026-31917 CVE-2026-43828 · GHSA-c6r4-qjmw-cvj2

LOW 26

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00272 Published 2026-05-25 Partial fix · 2.2.0, 3.0.0-alpha-2 CWE-614

TI-2026-31916 CVE-2026-43827 · GHSA-fcvm-3cpj-f9qx

LOW 27

Default configurations of Apache Shiro have a session fixation vulnerability.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00412 Published 2026-05-25 Partial fix · 2.2.0, 3.0.0-alpha-2 CWE-384