---
id: "CVE-2026-109928"
kind: "vulnerability"
aliases: ["CVE-2026-109928"]
title: "Apache OFBiz: password-reset token accepted at login grants full session"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Apache OFBiz", "fixed": ["24.09.08"], "affected": "< 24.09.08", "ecosystem": "vendor"}]
ecosystems: []
tags: ["apache-ofbiz", "erp", "java", "package", "self-hosted"]
not_affected_if: ["mail-transport-protected", "not-24.09-branch"]
published_at: "2026-11-05T14:17:00+00:00"
first_seen_at: "2026-11-05T14:39:17+00:00"
updated_at: "2026-11-05T14:42:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109928", "first_seen_at": "2026-11-05T14:39:17+00:00"}, {"source": "analyst", "url": "https://ofbiz.apache.org/security.html", "first_seen_at": "2026-11-05T14:42:29+00:00", "cites": ["https://ofbiz.apache.org/security.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-109928"]}]
exploit_sources: []
---

# Apache OFBiz: password-reset token accepted at login grants full session

Apache OFBiz 24.09 before 24.09.08 validates password-reset JWT tokens incorrectly in the login path. An attacker holding a user's reset token can submit it to the login endpoint and get a full session, including administrator access if the account is an admin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache OFBiz affected < 24.09.08 fixed 24.09.08

## How to check

Find your OFBiz release (the version in the build or release notes of your deployment). If it is below 24.09.08, you are affected. The vendor page gives no lower bound; NVD says it starts at 24.09. Also check whether password-reset tokens or emails could have been exposed, since a leaked reset token gives a full session.

## Fix

Upgrade Apache OFBiz to 24.09.08 (fix is PR #2277 per the OFBiz security page).

## Timeline

- 2026-11-05T14:39:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109928
- 2026-11-05T14:42:29+00:00 analyst https://ofbiz.apache.org/security.html — Apache OFBiz security page lists CVE-2026-109928: affected releases before 24.09.08, fixed in 24.09.08 with PR #2277. The page gives no lower bound; the NVD-derived summary says it starts at 24.09. Mechanism comes from NVD only. No exploitation or PoC found; I did not search X or Bluesky.

## Documents

- [advisory] Apache OFBiz Security - list of known vulnerabilities https://ofbiz.apache.org/security.html
- [describes] NVD CVE-2026-109928 https://nvd.nist.gov/vuln/detail/CVE-2026-109928

## From the sources

Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative access if the targeted account is an administrator, by submitting the token directly to the login endpoint instead of the intended password-change flow. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_