CVE-2026-82907

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description An authentication bypass exists in the ExternalLoginKeysManager due to a capture-replay flaw. A remote unauthenticated attacker who captures a live externalLoginKey value can obtain a complete, reusable session as the user who issued it across all accessible webapps. This occurs because the checkExternalLoginKey() function operates as a global preprocessor that executes before CSRF and authentication checks. The system accepts the key as a bearer credential that is not bound to a client, does not expire, and is not invalidated after use. Additionally, the framework appends live keys to cross-webapp links and allows an authenticated user's key to be sent to an attacker-controlled absolute URL via the WidgetWorker unvalidated inter-app link target.

Recommendations Upgrade to version 24.09.08.