Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Maven org.apache.shiro:shiro-jakarta-ee · Upgrade to 3.0.0-alpha-2 (pre-release) or 2.2.1 by release line · >= 2.0-alpha, < 2.2.1; >= 3.0.0-alpha-0, < 3.0.0-alpha-2 · CVE-2026-48589 · GHSA-7pq2-fhx9-x464