GHSA-7pq2-fhx9-x464: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
AI Analysis
Technical Summary
The vulnerability in Apache Shiro's Jakarta EE module arises from using the HTTP Referer header to issue redirects after user login without sufficient validation. Because the Referer header is client-controlled, an attacker could manipulate it to redirect users to arbitrary URLs. This affects Apache Shiro versions 2.0-alpha through 2.2.0 and 3.0.0-alpha-1 when the shiro-jakarta-ee module is used. The vulnerability is classified as CWE-601 (Open Redirect).
Potential Impact
An attacker can influence the redirect target after login by manipulating the HTTP Referer header, potentially redirecting users to malicious sites. This could be used in phishing or social engineering attacks. However, the severity is rated low, indicating limited impact or exploitability in typical scenarios.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, developers should avoid relying on the HTTP Referer header for redirects or implement strict validation of redirect targets to prevent open redirect issues.
GHSA-7pq2-fhx9-x464: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Description
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Apache Shiro's Jakarta EE module arises from using the HTTP Referer header to issue redirects after user login without sufficient validation. Because the Referer header is client-controlled, an attacker could manipulate it to redirect users to arbitrary URLs. This affects Apache Shiro versions 2.0-alpha through 2.2.0 and 3.0.0-alpha-1 when the shiro-jakarta-ee module is used. The vulnerability is classified as CWE-601 (Open Redirect).
Potential Impact
An attacker can influence the redirect target after login by manipulating the HTTP Referer header, potentially redirecting users to malicious sites. This could be used in phishing or social engineering attacks. However, the severity is rated low, indicating limited impact or exploitability in typical scenarios.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, developers should avoid relying on the HTTP Referer header for redirects or implement strict validation of redirect targets to prevent open redirect issues.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7pq2-fhx9-x464
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48589"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- LOW
- Cvss Version
- 4.0
Threat ID: 6a520eab68715ace438f49b8
Added to database: 07/11/2026, 09:36:43 UTC
Last enriched: 07/11/2026, 09:46:37 UTC
Last updated: 07/14/2026, 09:12:15 UTC
Views: 33
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.