CVE-2026-44598 Details
Description
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
A vulnerability allowing URL redirection to untrusted sites (open redirect) and server-side request forgery (SSRF) has been identified in the Apache Shiro Jakarta EE integration module. This issue affects versions 2.0-alpha through 2.1.0 and 3.0.0-alpha-1. The vulnerability arises because the shiroSavedRequest cookie, used to redirect users after login, was not properly validated. As a result, an attacker could forge the cookie to have the server send an HTTP GET request to an arbitrary URL.
Users are advised to upgrade to Apache Shiro version 2.1.1 or 3.0.0-alpha-2 or later, both of which address the vulnerability by encrypting the shiroSavedRequest cookie.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/25/8 | CVE | Mailing ListThird Party Advisory |
| https://shiro.apache.org/security-reports.html#cve_2026_44598 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache shiro | >= 2.0.0, < 2.1.1 3.0.0 alpha1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 25, 2026 | CVE Modified | CVE |
| May 25, 2026 | New CVE Received | [email protected] |