CVE-2026-82907 Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every...

PT-2026-137505

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07 Description An authentication bypass exists in the ExternalLoginKeysManager due to a capture-replay flaw. A remote unauthenticated attacker who captures a live externalLoginKey value can obtain a...