CVE-2026-31986
Hard-coded Cryptographic Key in Apache OFBiz
Publication date: 2026-05-19
Last updated on: 2026-05-19
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | ofbiz | to 24.09.06 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Use of Hard-coded Cryptographic Key issue in Apache OFBiz. It means that the software uses a fixed cryptographic key embedded in its code, which can be exploited by attackers to compromise the security of encrypted data or authentication mechanisms.
How can this vulnerability impact me? :
The impact of this vulnerability is that attackers who discover the hard-coded cryptographic key can potentially decrypt sensitive information, impersonate users, or bypass security controls within Apache OFBiz. This can lead to unauthorized access, data breaches, and loss of confidentiality.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache OFBiz to version 24.09.06, which fixes the hard-coded cryptographic key vulnerability.