Apache Shiro's Jakarta EE integration module versions 2.0.0-alpha and 3.0.0-alpha contain a vulnerability where the shiroSavedRequest cookie, used to redirect users after login, is not validated. An attacker with valid credentials can forge this cookie to cause an open redirect to untrusted sites and trigger server-side request forgery (SSRF) by making the server send HTTP GET requests to arbitrary URLs specified in the cookie. The vulnerability is addressed by encrypting the cookie in versions 2.1.1 and 3.0.0-alpha-2 or later.

An attacker who has valid login credentials can exploit this vulnerability to redirect users to untrusted external sites (open redirect) and cause the server to perform HTTP GET requests to arbitrary URLs (SSRF). This can lead to phishing, information disclosure, or interaction with internal systems not otherwise accessible. The vulnerability does not allow privilege escalation or direct remote code execution but can be leveraged in multi-step attacks.

Users should upgrade Apache Shiro Jakarta EE module to version 2.1.1 or 3.0.0-alpha-2 or later, where the shiroSavedRequest cookie is encrypted to prevent forgery. No other mitigations are documented. Patch status is confirmed by the vendor advisory recommending these versions.