With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request
    Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and
    3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended to upgrade to
    version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. After successful
    login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page
    after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server
    itself to an arbitrary URL from the cookie. (CVE-2026-44598)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request     Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and     3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended to upgrade to     version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. After successful     login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page     after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server     itself to an arbitrary URL from the cookie. (CVE-2026-44598)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
444182	SCA: security update for org.apache.shiro:shiro-jakarta-ee (GHSA-wpqm-4gwx-w843)	Tenable Cloud Security	SCA Checks	medium
444182	SCA: security update for org.apache.shiro:shiro-jakarta-ee (GHSA-wpqm-4gwx-w843)	Tenable Self-Hosted Container Security	SCA Checks	medium
317033	Linux Distros Unpatched Vulnerability : CVE-2026-44598	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-44598

medium

Tenable Plugins

medium

medium

medium