cve-2026-48589

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48589.json"
      }
    ],
    "title": "apache-shiro: shiro-jakarta-ee: Apache Shiro Jakarta EE module: Open Redirect via insufficient HTTP Referer header validation",
    "tracking": {
      "current_release_date": "2026-06-30T11:49:32+00:00",
      "generator": {
        "date": "2026-06-30T11:49:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.1"
        }
      },
      "id": "CVE-2026-48589",
      "initial_release_date": "2026-05-25T20:20:03.597000+00:00",
      "revision_history": [
        {
          "date": "2026-05-25T20:20:03.597000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-30T11:41:41+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-06-30T11:49:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
                  "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jbosseapxp"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"
          },
          {
            "category": "product_version",
            "name": "shiro-jakarta-ee",
            "product": {
              "name": "shiro-jakarta-ee",
              "product_id": "shiro-jakarta-ee",
              "product_identification_helper": {
                "purl": "pkg:maven/org.apache.shiro/shiro-jakarta-ee"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "shiro-jakarta-ee as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee"
        },
        "product_reference": "shiro-jakarta-ee",
        "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48589",
      "cwe": {
        "id": "CWE-601",
        "name": "URL Redirection to Untrusted Site ('Open Redirect')"
      },
      "discovery_date": "2026-05-25T21:01:15.756203+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481295"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Shiro's Jakarta EE module. Insufficient validation of the HTTP Referer header, a client-controlled value, could allow an attacker to influence the redirect target after a user login. This vulnerability can be exploited to redirect users to malicious sites, potentially leading to phishing attacks or other security bypasses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-shiro: shiro-jakarta-ee: Apache Shiro Jakarta EE module: Open Redirect via insufficient HTTP Referer header validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat ships Apache Shiro's Jakarta EE integration module (shiro-jakarta-ee) as a bundled dependency in EAP XP. A flaw was found where insufficient validation of the HTTP Referer header could allow an attacker to influence the redirect target after user login, potentially redirecting users to malicious sites. This vulnerability only affects applications using the shiro-jakarta-ee module specifically, not Apache Shiro core.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48589"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481295",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481295"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48589",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48589"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48589",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48589"
        },
        {
          "category": "external",
          "summary": "https://shiro.apache.org/security-reports.html#cve_2026_48589",
          "url": "https://shiro.apache.org/security-reports.html#cve_2026_48589"
        }
      ],
      "release_date": "2026-05-25T20:20:03.597000+00:00",
      "remediations": [
        {
          "category": "workaround",
          "details": "Ensure that applications using Apache Shiro's Jakarta EE module do not rely solely on the HTTP Referer header for post-login redirect decisions. Where possible, configure explicit redirect URLs in the application rather than accepting client-supplied values.",
          "product_ids": [
            "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee"
          ]
        },
        {
          "category": "none_available",
          "details": "Fix deferred",
          "product_ids": [
            "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee"
          ]
        }
      ],
      "title": "apache-shiro: shiro-jakarta-ee: Apache Shiro Jakarta EE module: Open Redirect via insufficient HTTP Referer header validation"
    }
  ]
}