When a user logs in, the Jakarta EE integration module stores the target page in a cookie named shiroSavedRequest and redirects the browser to that URL after authentication. The cookie is not validated, allowing an attacker to craft a forged value that causes the application server to request an arbitrary URL, resulting in server‑side request forgery. If the request is made to an untrusted external site it also creates an open redirect vulnerability, potentially exposing users to phishing or further exploitation. The impact is that an authenticated attacker can make the server act as a client to arbitrary destinations, leading to data exfiltration, internal network traversal, or hijacking of external services.

Apache Shiro Jakarta EE module, versions 2.0‑alpha through 2.1.0 and 3.0.0‑alpha‑1 are affected. Users should upgrade to 2.1.1 or later, or to 3.0.0‑alpha‑2 or later, where the shiroSavedRequest cookie is encrypted and validated.

The CVSS score of 5.1 indicates moderate severity. Exploitation requires valid credentials, so the likelihood of attack is lowered, but once logged in the attacker can issue arbitrary HTTP GET requests from the server itself. The vulnerability is not listed in CISA's KEV catalog and EPSS data is unavailable. Attackers can achieve the vulnerability by forging the shiroSavedRequest cookie after authenticating, then sending a crafted request to the application server; the server will forward the request to any URL contained in the cookie.