Authentication Bypass Vulnerability in Apache OFBiz by Apache Software Foundation

CVE-2026-82907

What is CVE-2026-82907?

The vulnerability in Apache OFBiz 24.09 allows an unauthenticated remote attacker to exploit the ExternalLoginKeysManager. By capturing a live externalLoginKey, the attacker can gain access to a valid session without needing any client-side validation. This session is reusable and does not expire, posing significant security risks as it enables the attacker to impersonate the legitimate user across all accessible web applications. The affected system fails to invalidate the key after each use, making it vulnerable to further exploitation through unvalidated links. Users should promptly upgrade to version 24.09.08 to mitigate these risks.

References