APACHE-OFBIZ · CVE-2026-105330 · Runtime
FIX → 24.09.08
Apache OFBiz 24.09.06 and 24.09.07 can accept JWTs signed with the factory-default security.token.key on deployments that kept an older security.properties with SSO enabled. An unauthenticated network attacker can forge a token and get full admin access. Fixed in 24.09.08, part of a 46-CVE release; the key must also be rotated.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments running OFBiz 24.09.06 or 24.09.07 that were upgraded from an older release and kept their existing security.properties with security.internal.sso.enabled set to true. Fresh installs generated after the CVE-2026-31986 fix are not described as affected. Upgrading alone does not replace an already-set key, so carried-forward configurations need the key rotation as well.
Not affected if 24.09.08-or-later, fresh-install, sso-disabled
Who cares apache-ofbiz, erp, java, self-hosted
24.09.06 or 24.09.07.framework/security/config/security.properties for security.internal.sso.enabled=true and whether security.token.key is still the default value.Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 24.09.08
24.09.08 (vendor: fixed with PR #2091)./gradlew rotateSecretKeys after upgradingNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.