{"id":"CVE-2026-105330","kind":"vulnerability","aliases":["CVE-2026-105330"],"related":[],"title":"Apache OFBiz: hard-coded JWT key lets attackers forge admin tokens","description":"Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.","summary":"Apache OFBiz 24.09.06 and 24.09.07 can accept JWTs signed with the factory-default security.token.key on deployments that kept an older security.properties with SSO enabled. An unauthenticated network attacker can forge a token and get full admin access. Fixed in 24.09.08, part of a 46-CVE release; the key must also be rotated.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apache-ofbiz","fixed":["24.09.08"],"affected":">= 24.09.06, < 24.09.08","ecosystem":"vendor"}],"ecosystems":[],"tags":["apache-ofbiz","erp","java","runtime","self-hosted"],"not_affected_if":["24.09.08-or-later","fresh-install","sso-disabled"],"how_to_check":"- Check the running version of Apache OFBiz is `24.09.06` or `24.09.07`.\n- Check `framework/security/config/security.properties` for `security.internal.sso.enabled=true` and whether `security.token.key` is still the default value.\n- Check whether the deployment was upgraded from a release predating the CVE-2026-31986 fix while keeping its existing security.properties.","fix":"Upgrade to Apache OFBiz 24.09.08 (vendor: fixed with PR #2091). Per the NVD/CVE text, upgrading alone does not replace an already-set key: if security.properties was carried forward from a release before the CVE-2026-31986 fix, also run './gradlew rotateSecretKeys' after upgrading.","status":"open","published_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:16+00:00","triaged_at":"2026-11-05T14:40:57+00:00","updated_at":"2026-11-05T14:42:51+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T14:40:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache OFBiz to `24.09.08`.\n- After upgrading, deployments that carried security.properties forward must also run './gradlew rotateSecretKeys', per the advisory text.","reach":"internet","title":"Apache OFBiz: hard-coded JWT key lets attackers forge admin tokens","impact":"high","summary":"Apache OFBiz 24.09.06 and 24.09.07 sign JWT tokens with a factory-default key on deployments upgraded from older releases that kept their security.properties with SSO enabled. An unauthenticated network attacker can forge a token and gain full administrative access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted","erp"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker forges admin JWT and takes full control of the OFBiz server.","analyst_note":"Severity is unknown in sources; confirm CVSS and the exact NVD advisory text for the rotateSecretKeys step at https://nvd.nist.gov/vuln/detail/CVE-2026-105330.","how_to_check":"- Check the running version of Apache OFBiz is `24.09.06` or `24.09.07`.\n- Check `framework/security/config/security.properties` for `security.internal.sso.enabled=true` and whether `security.token.key` is still the default value.\n- Check whether the deployment was upgraded from a release predating the CVE-2026-31986 fix while keeping its existing security.properties.","plain_action":"","needs_analyst":true,"not_affected_if":["fresh-install","sso-disabled","24.09.08-or-later"],"who_is_affected":"Only deployments running OFBiz 24.09.06 or 24.09.07 that were upgraded from an older release and kept their existing security.properties with security.internal.sso.enabled set to true. Fresh installs generated after the CVE-2026-31986 fix are not described as affected. Upgrading alone does not replace an already-set key, so carried-forward configurations need the key rotation as well.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000824,"input_tokens":4425,"output_tokens":764,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Severity is unknown in sources; confirm CVSS and the exact NVD advisory text for the rotateSecretKeys step at https://nvd.nist.gov/vuln/detail/CVE-2026-105330.","search":"'-105330':15A,18A '-2026':14A,17A,130C,187C '-31986':131C,188C '/gradlew':193C '24.09.06':33B,98C '24.09.07':35B,100C '24.09.08':71B,165C '46':75B 'accept':37B 'access':68B,115C 'admin':11A,67B 'administr':114C 'allow':104C 'alon':167C 'alreadi':173C,205C 'already-configur':172C 'already-set':204C 'also':81B,191C 'apach':1A,23B,31B,96C 'apache':20A 'apache-ofbiz':19A,22B 'attack':9A,59B,110C 'authent':94C 'carri':178C 'code':5A,88C 'configur':136C,174C 'cryptograph':89C 'cve':13A,16A,76B,129C,186C 'default':44B,125C 'deploy':47B,139C,176C 'enabl':55B 'erp':25B 'exist':151C,199C 'factori':43B,124C 'factory-default':42B,123C 'fix':69B,147C,189C 'forg':10A,61B,118C 'forward':180C 'framework/security/config/security.properties':179C 'full':66B,113C 'generat':135C 'generatesecretkey':200C 'get':65B 'hard':4A,87C 'hard-cod':3A,86C 'host':30B 'java':26B 'jwt':6A,92C,119C 'jwts':38B 'kept':49B 'key':7A,79B,90C,175C 'leav':202C 'let':8A 'must':80B,190C 'network':58B,108C 'network-reach':107C 'newli':134C 'obtain':112C 'ofbiz':2A,21A,24B,32B,97C 'older':51B 'part':72B 'platform':103C 'predat':145C,184C 'reachabl':109C 'recommend':160C 'releas':77B,144C,183C 'remov':132C 'replac':170C 'retain':149C 'rotat':83B 'rotatesecretkey':194C 'run':192C 'runtim':27B 'security.internal.sso.enabled':154C 'security.properties':52B,152C 'security.token.key':45B,126C 'self':29B 'self-host':28B 'set':155C,206C 'sign':39B,120C 'sinc':197C 'sso':54B 'task':201C 'token':12A,63B,93C 'true':157C 'unauthent':57B,106C 'untouch':208C 'upgrad':141C,162C,166C,196C 'use':84C 'user':158C 'valu':127C,207C 'version':164C 'via':116C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running OFBiz 24.09.06 or 24.09.07 that were upgraded from an older release and kept their existing security.properties with security.internal.sso.enabled set to true. Fresh installs generated after the CVE-2026-31986 fix are not described as affected. Upgrading alone does not replace an already-set key, so carried-forward configurations need the key rotation as well.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheofbiz"],"ptokens":["apache","ofbiz"],"labels":["apacheofbiz","critical","erp","java","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105330","severity":null,"published_at":"2026-11-05T14:16:59+00:00","modified_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:16+00:00","fetched_at":"2026-11-05T14:39:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105330:1785","url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","severity":null,"published_at":"2026-11-05T14:42:51+00:00","modified_at":"2026-11-05T14:42:51+00:00","first_seen_at":"2026-11-05T14:42:51+00:00","fetched_at":"2026-11-05T14:42:51+00:00","note":"Read Apache's oss-security announcement and ofbiz.apache.org/security page: fix 24.09.08 (PR #2091) confirmed. Vendor page and announcement say 'affected releases before 24.09.08' while NVD text narrows to 24.09.06-24.09.07 with retained default key; used NVD range for the product row. rotateSecretKeys step seen only in the NVD/CVE text, not on a vendor page, so nothing marked verified. No CVSS, no exploitation or PoC reported. X not checked.","cites":["https://www.openwall.com/lists/oss-security/2026/11/04/9","https://ofbiz.apache.org/security.html"]}],"documents":[{"id":76987,"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","title":"Apache OFBiz: CVE Announcements (oss-security, Jacopo Cappellato)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":76985,"url":"https://ofbiz.apache.org/security.html","title":"Apache OFBiz Security - list of known vulnerabilities","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}