---
id: "CVE-2026-105330"
kind: "vulnerability"
aliases: ["CVE-2026-105330"]
title: "Apache OFBiz: hard-coded JWT key lets attackers forge admin tokens"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "apache-ofbiz", "fixed": ["24.09.08"], "affected": ">= 24.09.06, < 24.09.08", "ecosystem": "vendor"}]
ecosystems: []
tags: ["apache-ofbiz", "erp", "java", "runtime", "self-hosted"]
not_affected_if: ["24.09.08-or-later", "fresh-install", "sso-disabled"]
published_at: "2026-11-05T14:16:59+00:00"
first_seen_at: "2026-11-05T14:39:16+00:00"
updated_at: "2026-11-05T14:42:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105330", "first_seen_at": "2026-11-05T14:39:16+00:00"}, {"source": "analyst", "url": "https://www.openwall.com/lists/oss-security/2026/11/04/9", "first_seen_at": "2026-11-05T14:42:51+00:00", "cites": ["https://www.openwall.com/lists/oss-security/2026/11/04/9", "https://ofbiz.apache.org/security.html"]}]
exploit_sources: []
---

# Apache OFBiz: hard-coded JWT key lets attackers forge admin tokens

Apache OFBiz 24.09.06 and 24.09.07 can accept JWTs signed with the factory-default security.token.key on deployments that kept an older security.properties with SSO enabled. An unauthenticated network attacker can forge a token and get full admin access. Fixed in 24.09.08, part of a 46-CVE release; the key must also be rotated.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apache-ofbiz affected >= 24.09.06, < 24.09.08 fixed 24.09.08

## How to check

- Check the running version of Apache OFBiz is `24.09.06` or `24.09.07`.
- Check `framework/security/config/security.properties` for `security.internal.sso.enabled=true` and whether `security.token.key` is still the default value.
- Check whether the deployment was upgraded from a release predating the CVE-2026-31986 fix while keeping its existing security.properties.

## Fix

Upgrade to Apache OFBiz 24.09.08 (vendor: fixed with PR #2091). Per the NVD/CVE text, upgrading alone does not replace an already-set key: if security.properties was carried forward from a release before the CVE-2026-31986 fix, also run './gradlew rotateSecretKeys' after upgrading.

## Timeline

- 2026-11-05T14:39:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105330
- 2026-11-05T14:42:51+00:00 analyst https://www.openwall.com/lists/oss-security/2026/11/04/9 — Read Apache's oss-security announcement and ofbiz.apache.org/security page: fix 24.09.08 (PR #2091) confirmed. Vendor page and announcement say 'affected releases before 24.09.08' while NVD text narrows to 24.09.06-24.09.07 with retained default key; used NVD range for the product row. rotateSecretKeys step seen only in the NVD/CVE text, not on a vendor page, so nothing marked verified. No CVSS, no exploitation or PoC reported. X not checked.

## Documents

- [advisory] Apache OFBiz: CVE Announcements (oss-security, Jacopo Cappellato) https://www.openwall.com/lists/oss-security/2026/11/04/9
- [fix] Apache OFBiz Security - list of known vulnerabilities https://ofbiz.apache.org/security.html

## From the sources

Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that CVE-2026-31986 removed from newly generated configurations, on a deployment that upgraded from a release predating that fix while retaining its existing security.properties with security.internal.sso.enabled set to true. Users are recommended to upgrade to version 24.09.08. Upgrading alone does not replace an already-configured key: deployments that carried framework/security/config/security.properties forward from a release predating the CVE-2026-31986 fix must also run './gradlew rotateSecretKeys' after upgrading, since the existing generateSecretKeys task leaves an already-set value untouched.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_