CVE-2026-105330

A flaw was found in Apache OFBiz. A remote, unauthenticated attacker can bypass authentication to obtain full administrative access by presenting a forged JSON Web Token JWT signed with a known factory-default cryptographic key. This issue arises when configurations retain default token signing...