CVE-2026-48589: Apache Shiro open redirect in Jakarta EE module

Executive brief

Apache Shiro, a security framework for Java applications, contains a vulnerability in its Jakarta EE integration module. An attacker can manipulate the login process to redirect users to a malicious external website instead of the intended application page. This could be used in phishing campaigns to trick users into providing credentials to a fraudulent site.

Technical details

An open redirect vulnerability (CWE-601) exists in the Apache Shiro Jakarta EE integration module. The vulnerability stems from the application using the client-controlled HTTP Referer header to determine the redirection target after a successful user login without adequate validation. An attacker can exploit this by crafting a link that, upon successful authentication, redirects the victim to an arbitrary external domain. This issue affects versions 2.0-alpha through 2.2.0 and 3.0.0-alpha-1. It has been patched in versions 2.2.1 and 3.0.0-alpha-2.

Affected products

• Apache Shiro >= 2.0-alpha, < 2.2.1; >= 3.0.0-alpha-0, < 3.0.0-alpha-2

Timeline

• 2026-05-25: disclosed
• 2026-05-26: advisory: GitHub Advisory published
• 2026-07-10: patched: Advisory updated with patch information

References

• https://api.github.com/users/yeikel
• https://github.com/yeikel
• https://api.github.com/users/yeikel/gists%7B/gist_id%7D
• https://api.github.com/users/yeikel/repos
• https://avatars.githubusercontent.com/u/8935151?v=4
• https://api.github.com/users/yeikel/events%7B/privacy%7D