Authentication Flaw in Apache OFBiz Password Reset Mechanism

CVE-2026-109928

What is CVE-2026-109928?

The vulnerability in Apache OFBiz arises from an improper implementation of the authentication algorithm in the password-reset and login JSON Web Token (JWT) validation. This flaw enables an attacker who has intercepted a user's password-reset token through email interception or other malicious means to authenticate as that user. By sending the token directly to the login endpoint, the attacker can gain full access to the user's session. This includes acquiring administrative privileges if the account is linked to an administrator role. To mitigate this risk, it is critical for users to upgrade to version 24.09.08 or later, which addresses this vulnerability.

References