Authentication bypass in Apache OFBiz through reusable login keys
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-294.
Summary
Apache OFBiz 24.09 before 24.09.08 on all platforms accepts the externalLoginKey value as a bearer credential that is never bound to a client, never expires and is not invalidated after use (CWE-294). A remote unauthenticated attacker who captures a live key can obtain a cookie-free, reusable session as the user who issued it in every webapp that user can reach.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Apache OFBiz to version 24.09.08, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA Apache OFBiz (Apache Software Foundation) Fixed in 24.09.08
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Apache OFBiz — lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83…
46 records Highest priority Priority MEDIUM 7 MEDIUM, 39 LOW
Other records, highest priority first
- TI-2026-85437 Code injection in Apache OFBiz lets unauthenticated attackers run codePriority MEDIUM 51
- TI-2026-85438 Incorrect authorization in Apache OFBiz lets attackers run commandsPriority MEDIUM 42
- TI-2026-85435 Code injection in Apache OFBiz CMS enables OS command executionPriority MEDIUM 41
Timeline
- 2026-11-05 Threatist record created from CVE-2026-82907
- 2026-11-05 Alias added: GHSA-5x82-v6v2-mgfh
- 2026-11-05 CVSS score added · CISA ADP
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: LOW → MEDIUM
- 2026-11-06 CISA SSVC decision points changed
References
More Apache vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
- TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-82907 · CVE Program
- CVE-2026-82907 · NVD
- FIRST EPSS
- GHSA-5x82-v6v2-mgfh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences