APACHE OFBIZ · CVE-2026-109928 · Package
FIX → 24.09.08 ✓ verified
Apache OFBiz 24.09 before 24.09.08 validates password-reset JWT tokens incorrectly in the login path. An attacker holding a user's reset token can submit it to the login endpoint and get a full session, including administrator access if the account is an admin.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Apache OFBiz installs (ERP/e-commerce) running a release before 24.09.08. Anyone who holds a user's password-reset token can submit it at login and get a full session, as an administrator if the account is one. Teams on 24.09.08 or later can skip it.
Not affected if mail-transport-protected, not-24.09-branch
Who cares apache-ofbiz, erp, java, self-hosted
24.09.08, you are affectedUpgrade to 24.09.08
Upgrade Apache OFBiz to 24.09.08 (fix is PR #2277 per the OFBiz security page).
Posts are quoted with a link to the original. They are data to us, never instructions.
Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative access if the targeted account is an administrator, by submitting the token directly to the login endpoint instead of the intended password-change flow. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.