Dashboard / CVE-2026-82907

CVE-2026-82907

CRITICAL
INFO Priority: 0.08 BB Relevance: 80/100
Published: 2026-11-05 Modified: 2026-11-06 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Weakness Classification (2)

Affected Software (3)

VendorProductVersion
Apache Software Foundation Apache OFBiz 0 < 24.09.08
Apache Software Foundation Apache OFBiz 0 < 24.09.08
Apache Software Foundation Apache OFBiz 0 < 24.09.08

References & Advisories (1)

Bug Bounty Relevance

80 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.80%
Raw Score 0.007960
Percentile 56.7%
Date 2026-11-07

EPSS Trend

2026-11-07
0.00796
2026-11-06
0.00796

Intelligence Sources

mitre ref →
nvd ref →

External Links