[<prev] [day] [month] [year] [list]
Message-ID: <6e090cab-f2bc-9ffd-eac3-6c9a1c84f9d9@apache.org>
Date: Mon, 25 May 2026 19:51:35 +0000
From: Lenny Primak <lprimak@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-48589: Apache Shiro: Jakarta EE open redirect via
untrusted Referer in post-login redirect flow
Severity:
Affected versions:
- Apache Shiro (org.apache.shiro:shiro-jakarta-ee) 2.0.0-alpha-0 through 2.2.0
- Apache Shiro (org.apache.shiro:shiro-jakarta-ee) 3.0.0-alpha-0 through 3.0.0-alpha-1
Description:
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login.
In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module.
This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Credit:
Bartlomiej Dmitruk <bartek@...iga.ai> (finder)
Lenny Primak <lenny@...wlogix.com> (remediation developer)
References:
https://shiro.apache.org/security-reports.html#cve_2026_48589
https://shiro.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-48589
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
