# CVE-2026-44598: Apache Shiro Open Redirect and SSRF in Jakarta EE module

Source: https://junglewise.ai/threats/cve-2026-44598-apache-shiro-open-redirect-and-ssrf-in-jakarta-ee-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-44598 · Severity: medium · CVSS 4 · Published 2026-05-25

Apache Shiro, a security framework for Java applications, contains a flaw in its Jakarta EE integration module. An attacker with valid login credentials can manipulate a specific browser cookie to redirect users to malicious websites or force the server to make unauthorized internal requests. This could lead to the exposure of internal network information or phishing attacks against users.

Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-44598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44598 being exploited in the wild.

**How severe is CVE-2026-44598?** Medium severity, with a CVSS score of 4, published 25 May 2026.

**Which products and versions are affected?** Apache Software Foundation Shiro Jakarta EE module 2.0.0-alpha-0 to 2.1.0, 3.0.0-alpha-1; org.apache.shiro:shiro-jakarta-ee (Maven) ECOSYSTEM:introduced=2.0.0-alpha-0,fixed=2.2.0.

**Is there a fix for CVE-2026-44598?** Yes. org.apache.shiro:shiro-jakarta-ee (Maven): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44598 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44598?** Check whether you run Apache Software Foundation Shiro Jakarta EE module or org.apache.shiro:shiro-jakarta-ee (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.shiro:shiro-jakarta-ee (Maven): upgrade to 2.2.0 or later

  ```sh
  # set org.apache.shiro:shiro-jakarta-ee to 2.2.0 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in the Apache Shiro Jakarta EE integration module where the 'shiroSavedRequest' cookie is not properly validated. After a successful login, the application uses this cookie to determine the redirection target. An authenticated attacker can forge this cookie to perform an Open Redirect or trigger a Server-Side Request Forgery (SSRF) via an HTTP GET request initiated by the server. The vulnerability is present in versions 2.0-alpha through 2.1.0 and 3.0.0-alpha-1. The fix, introduced in versions 2.2.0 and 3.0.0-alpha-2, involves encrypting the cookie to prevent tampering.

## Affected products

- Apache Software Foundation Shiro Jakarta EE module 2.0.0-alpha-0 to 2.1.0, 3.0.0-alpha-1

## Identifiers

- CVE-2026-44598
- GHSA-wpqm-4gwx-w843

## Timeline

- 2026-05-25: disclosed: Initial disclosure by Apache Software Foundation
- 2026-05-26: advisory: GitHub Advisory published

## References

- [https://shiro.apache.org/security-reports.html](https://shiro.apache.org/security-reports.html)
- [http://www.openwall.com/lists/oss-security/2026/05/25/8](http://www.openwall.com/lists/oss-security/2026/05/25/8)

## Related threats

- [Apache Shiro open redirect in Jakarta EE module](https://junglewise.ai/threats/cve-2026-48589-apache-shiro-open-redirect-in-jakarta-ee-module)