CVE-2026-109928
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass via JWT Token Misuse in Apache OFBiz

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative access if the targeted account is an administrator, by submitting the token directly to the login endpoint instead of the intended password-change flow. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-109928
EUVD
EUVD-2026-117519

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-303 The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect implementation of the authentication algorithm in Apache OFBiz 24.09 before 24.09.08. It allows an attacker who has a user's password-reset token to bypass the intended password-change flow and authenticate directly via the login endpoint. This grants full session access, including administrative privileges if the account is an admin.

Detection Guidance

This vulnerability involves improper JWT validation in Apache OFBiz 24.09 before 24.09.08. To detect it, check OFBiz version with commands like 'curl -s http://localhost:8080/ofbiz | grep OFBiz' or 'java -jar ofbiz.jar -version'. If version is below 24.09.08, the system is vulnerable.

Impact Analysis

If you use Apache OFBiz 24.09 before 24.09.08, an attacker could gain unauthorized access to your account by intercepting a password-reset token. This could lead to data theft, unauthorized actions, or full system compromise, especially if the account has administrative rights.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected versions may face compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the incorrect authentication implementation in JWT validation for password-reset and login flows.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109928. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...