PT-2026-41857 · Apache · Apache Ofbiz

Zhaokaifei

·

CVE-2026-41919

·

Published

2026-05-19

·

Updated

2026-05-19

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.06
Description Improper Neutralization of Special Elements used in an LDAP Query, also known as LDAP Injection, allows for authentication bypass due to improper neutralization of LDAP special elements in DN construction. LDAP Injection occurs when an application fails to properly sanitize user-supplied input before using it in a Lightweight Directory Access Protocol (LDAP) query, potentially allowing an attacker to manipulate the query logic.
Recommendations Upgrade to version 24.09.06.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-41919

Affected Products

Apache Ofbiz