CVE-2026-48589: Apache Shiro

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.

Affected products

• Apache Shiro: from 2.0.0, before 2.2.1 (fixed in 2.2.1); version 3.0.0 only

Published 2026-05-25. Last modified 2026-07-24.