[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5e821fdb-61e2-e383-4db9-9f85c0e319f4@apache.org>
Date: Mon, 25 May 2026 19:51:09 +0000
From: Lenny Primak <lprimak@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-44598: Apache Shiro Jakarta EE module: Open redirect and
SSRF (requires valid credentials)
Severity:
Affected versions:
- Apache Shiro Jakarta EE module (org.apache.shiro:shiro-jakarta-ee) 2.0.0-alpha-0 through 2.1.0
- Apache Shiro Jakarta EE module (org.apache.shiro:shiro-jakarta-ee) 3.0.0-alpha-0 through 3.0.0-alpha-1
Description:
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.
This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie.
After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login.
This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
Credit:
James Love <jameslove2k22@...il.com> (finder)
Lenny Primak <lenny@...wlogix.com> (remediation developer)
References:
https://shiro.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-44598
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
