How severe is CVE-2026-48589?

CVE-2026-48589 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-48589 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-48589?

CVE-2026-48589 primarily affects Apache Shiro. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-48589?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-48589 have an EU (EUVD) identifier?

Yes. CVE-2026-48589 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31738.

When was CVE-2026-48589 published?

CVE-2026-48589 was published on 2026-05-25 and last updated on 2026-06-17.

CVE-2026-48589

CVE-2026-48589 is a medium-severity vulnerability in Apache Shiro with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-601.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
CVSS v4: 0.0
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-31738
Weakness: CWE-601
Affected product: Apache Shiro
Published: 2026-05-25
Last modified: 2026-06-17

Description

Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.

Frequently asked questions

What is CVE-2026-48589?: Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
How severe is CVE-2026-48589?: CVE-2026-48589 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-48589 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-48589?: CVE-2026-48589 primarily affects Apache Shiro. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-48589?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-48589 have an EU (EUVD) identifier?: Yes. CVE-2026-48589 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-31738.
When was CVE-2026-48589 published?: CVE-2026-48589 was published on 2026-05-25 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:shiro:3.0.0:alpha1:*:*:*:*:*:*

More vulnerabilities in Apache Shiro

CVE-2023-34478 — Critical (CVSS 9.8): Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an…
CVE-2022-40664 — Critical (CVSS 9.8): Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via…
CVE-2022-32532 — Critical (CVSS 9.8): Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers.…
CVE-2021-41303 — Critical (CVSS 9.8): Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an…
CVE-2020-17523 — Critical (CVSS 9.8): Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an…
CVE-2020-17510 — Critical (CVSS 9.8): Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an…

All CVEs affecting Apache Shiro →

Other CWE-601 (Open Redirect) vulnerabilities

CVE-2018-3774 — Critical (CVSS 10.0): Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open…
CVE-2019-25282 — Critical (CVSS 9.8): V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to…
CVE-2020-36912 — Critical (CVSS 9.8): Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script…
CVE-2025-43526 — Critical (CVSS 9.8): This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac…
CVE-2025-55031 — Critical (CVSS 9.8): Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An…
CVE-2024-22891 — Critical (CVSS 9.8): Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.

Browse all CWE-601 (Open Redirect) vulnerabilities →