# CVE-2026-48589: Apache Shiro open redirect in Jakarta EE module

Source: https://junglewise.ai/threats/cve-2026-48589-apache-shiro-open-redirect-in-jakarta-ee-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-48589 · Severity: medium · CVSS 5.4 · Published 2026-05-25

Apache Shiro, a security framework for Java applications, contains a vulnerability in its Jakarta EE integration module. An attacker can manipulate the login process to redirect users to a malicious external website instead of the intended application page. This could be used in phishing campaigns to trick users into providing credentials to a fraudulent site.

Technologies: [Apache Shiro](https://junglewise.ai/threats/technologies/shiro). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-48589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48589 being exploited in the wild.

**How severe is CVE-2026-48589?** Medium severity, with a CVSS score of 5.4, published 25 May 2026.

**Which products and versions are affected?** Apache Shiro 2.0-alpha to 2.2.0, 3.0.0-alpha-1; org.apache.shiro:shiro-jakarta-ee (Maven) ECOSYSTEM:introduced=2.0-alpha,fixed=2.2.1.

**Is there a fix for CVE-2026-48589?** Yes. org.apache.shiro:shiro-jakarta-ee (Maven): upgrade to 2.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48589 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48589?** Check whether you run Apache Shiro or org.apache.shiro:shiro-jakarta-ee (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.shiro:shiro-jakarta-ee (Maven): upgrade to 2.2.1 or later

  ```sh
  # set org.apache.shiro:shiro-jakarta-ee to 2.2.1 in your pom.xml or build.gradle
  ```


## Technical details

An open redirect vulnerability (CWE-601) exists in the Apache Shiro Jakarta EE integration module. The vulnerability stems from the application using the client-controlled HTTP Referer header to determine the redirection target after a successful user login without adequate validation. An attacker can exploit this by crafting a link that, upon successful authentication, redirects the victim to an arbitrary external domain. This issue affects versions 2.0-alpha through 2.2.0 and 3.0.0-alpha-1. It has been patched in versions 2.2.1 and 3.0.0-alpha-2.

## Affected products

- Apache Shiro >= 2.0-alpha, < 2.2.1; >= 3.0.0-alpha-0, < 3.0.0-alpha-2

## Identifiers

- CVE-2026-48589
- GHSA-7pq2-fhx9-x464

## Timeline

- 2026-05-25: disclosed
- 2026-05-26: advisory: GitHub Advisory published
- 2026-07-10: patched: Advisory updated with patch information

## References

- [https://api.github.com/users/yeikel](https://api.github.com/users/yeikel)
- [https://github.com/yeikel](https://github.com/yeikel)
- [https://api.github.com/users/yeikel/gists%7B/gist_id%7D](https://api.github.com/users/yeikel/gists%7B/gist_id%7D)
- [https://api.github.com/users/yeikel/repos](https://api.github.com/users/yeikel/repos)
- [https://avatars.githubusercontent.com/u/8935151?v=4](https://avatars.githubusercontent.com/u/8935151?v=4)
- [https://api.github.com/users/yeikel/events%7B/privacy%7D](https://api.github.com/users/yeikel/events%7B/privacy%7D)

## Related threats

- [Apache Shiro SSRF in Jakarta EE integration module](https://junglewise.ai/threats/cve-2026-58301-apache-shiro-ssrf-in-jakarta-ee-integration-module)
- [Apache Shiro Open Redirect and SSRF in Jakarta EE module](https://junglewise.ai/threats/cve-2026-44598-apache-shiro-open-redirect-and-ssrf-in-jakarta-ee-module)
- [Apache Shiro session fixation in default configuration](https://junglewise.ai/threats/cve-2026-43827-apache-shiro-session-fixation-in-default-configuration)
- [Apache Shiro authentication bypass via case-sensitive filename matching](https://junglewise.ai/threats/cve-2026-23903-apache-shiro-authentication-bypass-via-case-sensitive-filename)
- [Improper Access Control in Apache Shiro](https://junglewise.ai/threats/cve-2016-4437-apache-shiro-code-execution-vulnerability)