CVE-2026-44598: Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.
This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie.
After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Shiro Jakarta EE moduleto a version that resolves this vulnerability.Fixed in 2.1.1 - Upgrade
Upgrade
Apache Shiro Jakarta EE moduleto a version that resolves this vulnerability.Fixed in 3.0.0-alpha-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44598?
CVE-2026-44598 has a medium severity rating of 5.1 based on the CVSS score.
How do I fix CVE-2026-44598?
To mitigate CVE-2026-44598, update to a fixed version of Apache Shiro that is not affected by this vulnerability.
What types of attacks are associated with CVE-2026-44598?
CVE-2026-44598 is associated with Open Redirect and Server-Side Request Forgery (SSRF) attacks.
Which versions of Apache Shiro are affected by CVE-2026-44598?
CVE-2026-44598 affects Apache Shiro versions from 2.0-alpha to 2.1.0 and 3.0.0-alpha-1 when using the shiro-jakarta-ee integration module.
Do valid credentials affect the exploitation of CVE-2026-44598?
Yes, exploitation of CVE-2026-44598 requires valid login credentials.