CVE-2026-105330

Apache OFBiz versions 24.09.06 and 24.09.07 on all platforms are vulnerable to unauthenticated administrative access due to the use of a hard-coded cryptographic key (CWE-321) in JWT token authentication. An attacker can obtain full administrative access by forging a JWT signed with the factory-d...