EUVD-2026-31739
GHSA-wpqm-4gwx-w843
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:Green
Authenticated network attacker (PR:L) requires user interaction to trigger post-login redirect; scope changes because server originates outbound SSRF requests to other systems.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.
This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie.
After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
AnalysisAI
Open redirect and server-side request forgery in Apache Shiro's Jakarta EE integration module allow authenticated users to forge the unvalidated shiroSavedRequest cookie, causing the server to issue outbound HTTP GET requests to arbitrary URLs or redirect users to untrusted sites. Affected deployments span Shiro 2.0-alpha through 2.1.0 and 3.0.0-alpha-1, exclusively when the shiro-jakarta-ee module is deployed - a scoped condition that materially limits the attack surface. No public exploit or active exploitation has been identified; EPSS sits at 0.04% (12th percentile), consistent with SSVC exploitation status of 'none'.
Technical ContextAI
Apache Shiro is a widely used Java security framework providing authentication, authorization, and session management. The affected component is the shiro-jakarta-ee integration module (CPE: cpe:2.3:a:apache_software_foundation:apache_shiro_jakarta_ee_module), which bridges Shiro with Jakarta EE - the successor to Java EE - to provide container-integrated security features. After a successful login, this module stores the originally requested URL in a cookie named shiroSavedRequest and uses it to redirect the user post-authentication. Because this cookie was neither cryptographically signed nor encrypted, a malicious authenticated user can set it to an arbitrary URL before login. The server then honors this value directly: it either redirects the browser to an external untrusted site (open redirect, CWE-601) or, more critically, issues an HTTP GET from the server itself to the attacker-specified URL (SSRF), potentially allowing internal network probing. The fix in 2.1.1 and 3.0.0-alpha-2 resolves this by encrypting the cookie, removing the ability to forge its contents.
RemediationAI
The primary and recommended fix is to upgrade the Apache Shiro Jakarta EE module to version 2.1.1 (for the 2.x line) or 3.0.0-alpha-2 or later (for the 3.x alpha line), both of which resolve the vulnerability by encrypting the shiroSavedRequest cookie to prevent forgery. The vendor advisory is at https://shiro.apache.org/security-reports.html#cve_2026_44598. If immediate upgrade is not feasible, a targeted compensating control is to enforce egress firewall rules on the application server to restrict outbound HTTP/HTTPS requests to known-legitimate destinations only; this limits the SSRF impact by preventing server-initiated requests to internal or arbitrary external targets, though it does not address the open redirect component. A more complete interim workaround, where Jakarta EE integration is not functionally required, is to remove or disable the shiro-jakarta-ee module entirely, eliminating the vulnerability at the cost of losing the post-login saved-request redirect functionality.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today