This vulnerability in Apache Shiro arises from the Jakarta EE integration module that allows a low‑privileged user to send a specially crafted POST request. The server then resolves a redirect URI and initiates an outbound connection to an attacker‑controlled host, sending data supplied by the attacker. This server‑side request forgery, classified as CWE‑918, enables the attacker to potentially retrieve internal resources, exfiltrate data, or trigger malicious actions on upstream services without authentication.

The affected product is Apache Shiro, versions 2.x up through 3.0.0, when used with the Jakarta EE integration module. All installations that rely on this module and have not applied the 3.0.1 update are vulnerable.

The CVSS score of 5.9 indicates moderate severity. The vulnerability is not currently listed on the CISA KEV catalog. Exploitation requires only a low‑privileged user to send a POST request to the application. The attacker can steer the server to any host, potentially accessing internal network services or communicating with external malicious endpoints, without needing elevated permissions or additional authentication.