Hard-coded Cryptographic Key Vulnerability in Apache OFBiz by Apache

CVE-2026-105330

What is CVE-2026-105330?

A security flaw in Apache OFBiz versions 24.09.06 and 24.09.07 allows attackers to bypass authentication due to the presence of a hard-coded cryptographic key in JWT token authentication. This vulnerability permits attackers, who are network-reachable, to gain full administrative access by forging a JWT token signed with a default security key. This issue primarily affects deployments that have upgraded from older versions but retained their previous security configurations. Users are advised to upgrade to version 24.09.08 and must execute './gradlew rotateSecretKeys' to ensure the security token key is rotated properly.

References