---
id: "CVE-2026-82907"
kind: "vulnerability"
aliases: ["CVE-2026-82907"]
title: "Apache OFBiz: captured login key grants reusable session across webapps"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-ofbiz", "java", "package", "self-hosted"]
not_affected_if: ["fixed-version"]
published_at: "2026-11-05T14:17:05+00:00"
first_seen_at: "2026-11-05T14:39:18+00:00"
updated_at: "2026-11-05T14:40:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82907", "first_seen_at": "2026-11-05T14:39:18+00:00"}]
exploit_sources: []
---

# Apache OFBiz: captured login key grants reusable session across webapps

Apache OFBiz 24.09 before 24.09.08 accepts an externalLoginKey value as a bearer credential that never expires and is not invalidated after use. An attacker who captures a live key can take a complete, cookie-free session as that user in every webapp the user can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version in the framework's version file or release package; affected versions are `24.09` before `24.09.08`.
- Look for `externalLoginKey` appearing in links or URLs in your deployment's logs or proxy access logs.

## Fix

- Apache OFBiz: upgrade to `24.09.08`.

## Timeline

- 2026-11-05T14:39:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82907

## From the sources

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_