CVE-2026-82907 · Package
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 accepts an externalLoginKey value as a bearer credential that never expires and is not invalidated after use. An attacker who captures a live key can take a complete, cookie-free session as that user in every webapp the user can reach.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform, where users reach multiple webapps. The framework appends live login keys to cross-webapp links and can send a user's key to an attacker-chosen URL via WidgetWorker, so exposure depends on users browsing that application. Deployments on versions outside 24.09.x, or already on 24.09.08 or later, are not affected by this entry.
Not affected if fixed-version
Who cares apache-ofbiz, java, self-hosted
24.09 before 24.09.08.externalLoginKey appearing in links or URLs in your deployment's logs or proxy access logs.24.09.08.Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.