CVE-2026-82907
Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass via Capture-Replay in Apache OFBiz

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-82907
EUVD
EUVD-2026-117477

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Apache OFBiz 24.09 before 24.09.08. It allows a remote attacker to capture a live externalLoginKey and reuse it to gain unauthorized access to a user's session without cookies. The issue occurs because the system accepts the key as a bearer credential without binding it to a client, expiration, or invalidation after use.

Detection Guidance

This vulnerability cannot be detected through standard commands as it requires identifying improper session handling in Apache OFBiz 24.09 before 24.09.08. Check if your OFBiz version is below 24.09.08 and upgrade immediately if so.

Impact Analysis

An attacker could exploit this to impersonate users, access sensitive data, or perform actions on their behalf across all webapps the victim can reach. Since the key is reusable and not bound to a specific session, the impact includes potential data breaches, unauthorized transactions, or full account takeover.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection), HIPAA (health data security), or other regulations by enabling unauthorized access to personal or sensitive data. Organizations using vulnerable versions may face legal penalties, reputational damage, and audit failures due to inadequate security controls.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the authentication bypass issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...