Apache Shiro’s Jakarta EE integration module uses the HTTP Referer header after a user logs in to determine where to redirect. Because the value is not validated, an attacker can supply a crafted Referer header so that after login the user is redirected to an arbitrary site. This open redirect weakness (CWE-601) can be used to conduct phishing attacks, drive malicious traffic, or obscure the path of user navigation. The vulnerability allows the attacker to influence the redirect target only after the user authenticates, giving the false impression of legitimate service flow.

Apache Shiro from the Apache Software Foundation is vulnerable in versions 2.0-alpha through 2.2.0 and in 3.0.0-alpha-1, but only when the shiro-jakarta-ee integration module is in use.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the public exploitation likelihood is unclear. The attack vector requires sending a login request with a manipulated Referer header; successful exploitation would redirect the authenticated user to a site chosen by the attacker. Because the flaw is an open redirect, the impact is limited to user‑experience and phishing rather than direct code execution or data theft.