PT-2026-43121 · Apache+1 · Apache Shiro+1

Bartlomiej Dmitruk · Published 2026-05-25 · Updated 2026-05-25 · CVE-2026-48589

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions 2.0-alpha through 2.2.0 Apache Shiro version 3.0.0-alpha-1

Description The Jakarta EE module in Apache Shiro uses the HTTP Referer header to issue redirects after user login. Insufficient validation of this client-controlled value allows an attacker to influence the redirect target in applications utilizing the shiro-jakarta-ee integration module.

Recommendations Update Apache Shiro versions 2.0-alpha through 2.2.0 to a fixed version. Update Apache Shiro version 3.0.0-alpha-1 to a fixed version. Restrict the use of the shiro-jakarta-ee integration module as a temporary mitigation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-48589

Affected Products

Apache Shiro

Shiro

References · 7

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48589 · Vendor Advisory
• https://shiro.apache.org/security-reports.html#cve_2026_48589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48589 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-48589 · Security Note
• https://ubuntu.com/security/CVE-2026-48589 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/05/25/9 · Note
• https://openwall.com/lists/oss-security/2026/05/25/9 · Note