CVE-2026-105330
UnknownSummary
Use of a hard-coded cryptographic key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.
Risk Assessment
Potential full administrative access by an unauthenticated attacker, posing a critical threat to system security.
Recommendation
Upgrade Apache OFBiz to version 24.09.08, and if the configuration was carried forward from a release predating the CVE-2026-31986 fix, run './gradlew rotateSecretKeys' after upgrading.
Other vulnerabilities in Apache OFBiz
See all- CVE-2026-97356Unknown
An External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 allows an authenticated user with only the LABEL_MANAGER_VIEW permission to read arbitrary properties and XML files on the server, including the JWT signing key, enabling forgery of an authenticated administrator session.
- CVE-2026-97355Unknown
A Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties.
- CVE-2026-92887Unknown
An incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 allows a remote, unauthenticated attacker to invoke a REST API operation without valid credentials when a definition omits the auth attribute, which is incorrectly resolved to false instead of the true default.
- CVE-2026-83538Unknown
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to disclose internal business records (organization, employee, product catalog, and product-store data) by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that skip authentication and perform no permission check.
- CVE-2026-114277Unknown
Authentication bypass by Assumed-Immutable data in the optional Janrain Engage Social Login integration in the ecommerce component of Apache OFBiz before 24.09.08 improperly binds authenticated external identities to local user accounts.
- CVE-2026-114272Unknown
Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with role-scoped content view permission to read data of content they are not authorized to view via a ViewSimpleContent request combining a contentId they can view with the dataResourceId of other content.
- CVE-2026-114271Unknown
Authorization bypass through a user-controlled key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify or take ownership of another party's shopping list and read its contents by supplying the other party's shopping list ID to the update endpoint.
- CVE-2026-114235Unknown
Direct request (forced browsing) in the Order component in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint.
- CVE-2026-114233Unknown
Incorrect privilege assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user holding only ORDERMGR_VIEW permission, without ORDERMGR_UPDATE or any role on the order, to modify approved orders — changing a ship group's shipping address and shipment method or appending items with an overridden price — via the updateShipGroupShipInfo and appendOrderItem services.
- CVE-2026-114229Unknown
Improper neutralization of input during web page generation (cross-site scripting) in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application.
Original NVD description (English source)
Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS