{"id":"CVE-2026-109928","kind":"vulnerability","aliases":["CVE-2026-109928"],"related":[],"title":"Apache OFBiz: password-reset token accepted at login grants full session","description":"Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative access if the targeted account is an administrator, by submitting the token directly to the login endpoint instead of the intended password-change flow. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 validates password-reset JWT tokens incorrectly in the login path. An attacker holding a user's reset token can submit it to the login endpoint and get a full session, including administrator access if the account is an admin.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache OFBiz","fixed":["24.09.08"],"affected":"< 24.09.08","ecosystem":"vendor"}],"ecosystems":[],"tags":["apache-ofbiz","erp","java","package","self-hosted"],"not_affected_if":["mail-transport-protected","not-24.09-branch"],"how_to_check":"Find your OFBiz release (the version in the build or release notes of your deployment). If it is below 24.09.08, you are affected. The vendor page gives no lower bound; NVD says it starts at 24.09. Also check whether password-reset tokens or emails could have been exposed, since a leaked reset token gives a full session.","fix":"Upgrade Apache OFBiz to 24.09.08 (fix is PR #2277 per the OFBiz security page).","status":"open","published_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:51+00:00","updated_at":"2026-11-05T14:42:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T14:40:51Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz 24.09 users: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: password-reset token accepted at login grants full session","impact":"high","summary":"Apache OFBiz 24.09 before 24.09.08 validates password-reset JWT tokens incorrectly in the login path. An attacker holding a user's reset token can submit it to the login endpoint and get a full session, including administrator access if the account is an admin.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","java","erp","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker logs in as any user, including administrators, with full access","analyst_note":"Confirm the affected version range beyond 24.09 and whether the NVD entry is the only source; check the Apache OFBiz security page.","how_to_check":"- Check the Apache OFBiz version in the deployed build, for example `24.09.07` or lower is affected in the 24.09 line\n- Confirm whether the instance is on the 24.09 branch and whether password-reset emails are sent by it","plain_action":"","needs_analyst":true,"not_affected_if":["not-24.09-branch","mail-transport-protected"],"who_is_affected":"Any Apache OFBiz 24.09 deployment before 24.09.08 on any platform is affected, since the flaw is in the JWT validation used by password reset and login. Exposure depends on whether an attacker can obtain a reset token through email interception, logs, or a man-in-the-middle on mail transport. Instances on other branches are not named in the source.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4322,"output_tokens":608,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the affected version range beyond 24.09 and whether the NVD entry is the only source; check the Apache OFBiz security page.","search":"'-109928':15A,18A '-2026':14A,17A '24.09':32B,92C '24.09.08':34B,94C,172C 'accept':7A 'access':68B,140C 'account':71B,144C 'admin':74B 'administr':67B,139C,147C 'algorithm':79C 'allow':98C 'apach':1A,22B,30B,90C 'apache':19A 'apache-ofbiz':21B 'attack':47B,100C 'authent':78C,128C 'chang':163C 'cve':13A,16A 'direct':152C 'email':112C 'endpoint':60B,156C 'erp':24B 'exposur':115C 'fix':174C 'flow':164C 'full':11A,64B,135C 'get':62B 'grant':10A 'hold':48B 'host':29B 'implement':76C 'includ':66B,138C 'incorrect':41B,75C 'instead':157C 'intend':160C 'intercept':113C 'issu':176C 'java':25B 'jwt':39B,87C 'log':114C 'login':9A,44B,59B,86C,155C 'mail':125C 'man':119C 'man-in-the-middl':118C 'middl':122C 'obtain':103C,133C 'ofbiz':2A,20A,23B,31B,91C 'packag':26B 'password':4A,37B,83C,108C,162C 'password-chang':161C 'password-reset':3A,36B,82C,107C 'path':45B 'platform':97C 'recommend':167C 'reset':5A,38B,52B,84C,109C 'self':28B 'self-host':27B 'session':12A,65B,137C 'submit':55B,149C 'target':143C 'token':6A,40B,53B,110C,151C 'transport':126C 'unrestrict':136C 'upgrad':169C 'user':50B,105C,131C,165C 'valid':35B,88C 'version':171C 'via':111C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Apache OFBiz installs (ERP/e-commerce) running a release before 24.09.08. Anyone who holds a user's password-reset token can submit it at login and get a full session, as an administrator if the account is one. Teams on 24.09.08 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T14:42:29Z","by":"analyst","doc":"https://ofbiz.apache.org/security.html","run_id":1788},"products":{"at":"2026-11-05T14:42:29Z","by":"analyst","doc":"https://ofbiz.apache.org/security.html","run_id":1788}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheofbiz","ofbiz"],"ptokens":["apache","ofbiz"],"labels":["apacheofbiz","erp","high","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109928","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109928","severity":null,"published_at":"2026-11-05T14:17:00+00:00","modified_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109928:1788","url":"https://ofbiz.apache.org/security.html","severity":null,"published_at":"2026-11-05T14:42:29+00:00","modified_at":"2026-11-05T14:42:29+00:00","first_seen_at":"2026-11-05T14:42:29+00:00","fetched_at":"2026-11-05T14:42:29+00:00","note":"Apache OFBiz security page lists CVE-2026-109928: affected releases before 24.09.08, fixed in 24.09.08 with PR #2277. The page gives no lower bound; the NVD-derived summary says it starts at 24.09. Mechanism comes from NVD only. No exploitation or PoC found; I did not search X or Bluesky.","cites":["https://ofbiz.apache.org/security.html","https://nvd.nist.gov/vuln/detail/CVE-2026-109928"]}],"documents":[{"id":76985,"url":"https://ofbiz.apache.org/security.html","title":"Apache OFBiz Security - list of known vulnerabilities","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":76994,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109928","title":"NVD CVE-2026-109928","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}