CVE-2026-82907

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every...

CVE-2026-82907 Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every...

CVE-2026-82907

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to an Authentication Bypass by Capture-replay in the ExternalLoginKeysManager component. The root cause is that checkExternalLoginKey runs as a global preprocessor before CSRF and authentication checks, accepting the key as a bearer crede...

EUVD-2026-117477

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every...

PT-2026-137505

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07 Description An authentication bypass exists in the ExternalLoginKeysManager due to a capture-replay flaw. A remote unauthenticated attacker who captures a live externalLoginKey value can obtain a...