CVE-2026-90878

A Code Injection vulnerability in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding mainDecoratorLocation, causing evaluation of an unsandboxed Groovy expression.

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.

Cross-site Scripting (XSS) vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in page chrome fields (header, nav, footer, etc.), so applications that place request-derived values there reflect them unencoded.

HTTP Response Splitting (CRLF injection in HTTP headers) vulnerability in Apache Juneau. The REST server passed response header values and redirect targets to the servlet container unchecked, so request-derived data could allow header injection or redirect to an arbitrary site.

Insufficiently Protected Credentials vulnerability in Apache Juneau. The RestClient followed HTTP redirects while keeping credential headers from the original request, so a server redirecting to a different host, port, or from HTTPS to HTTP could receive Authorization, Cookie, Proxy-Authorization and X-API-Key headers.

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response and may include internal exception messages in the error body, even with stack-trace rendering disabled.

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests ending in a server error without redaction, so Authorization, Cookie, Proxy-Authorization and X-API-Key headers are written in cleartext to the application log.

Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body and is enabled by default on every HTTP method including GET, so a cross-site link can deliver an attacker-chosen request body without a CORS preflight.

Improper control of dynamically-loaded code vulnerability in Apache Juneau. When parsing a value into a property of type java.lang.Class, the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer.

Path Traversal vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory; when an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root.