CVE-2026-44598
Description
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.
This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie.
After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.shiro:shiro-jakarta-eeMaven | >= 2.0.0-alpha-0, < 2.2.0 | 2.2.0 |
org.apache.shiro:shiro-jakarta-eeMaven | >= 3.0.0-alpha-1, < 3.0.0-alpha-2 | 3.0.0-alpha-2 |
Affected products
4Patches
Vulnerability mechanics
References
4- www.openwall.com/lists/oss-security/2026/05/25/8nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-wpqm-4gwx-w843ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-44598ghsaADVISORY
- shiro.apache.org/security-reports.htmlnvdVendor AdvisoryWEB
News mentions
1- Apache Ships 12 Patches Across 7 Projects: Shiro, Airflow, Syncope Lead the BatchVypr Intelligence · May 28, 2026