Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 25, 2026 · NIST NVD

   Detected

   Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakar

2. Jul 24, 2026 · NIST NVD

   Updated

   Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakar

Affected

• cpe apache/shiroversion unspecified
• cpe apache/shiro3.0.0

Sources

• CVE.orgVulnerability recordCVE-2026-48589

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-48589

  Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Ja

  nvd.nist.gov

References

• Mailing List · openwall.com
• Vendor Advisory · shiro.apache.org