Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass
Apache OFBiz
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Apache OFBiz 24.09.08 fixes 46 vulnerabilities in every earlier release, several of them critical. Unauthenticated attackers can run code on the server through login-page widget injection (CVE-2026-83542), attacker-controlled Screen definition loading (CVE-2026-68524) and a saved-view authorization bypass (CVE-2026-73578). They can also take over a full user session by replaying a captured externalLoginKey (CVE-2026-82907). On 24.09.06 and 24.09.07 deployments upgraded from older releases, a forged JWT signed with the old default key gives admin access (CVE-2026-105330). The batch also includes a password-reset account takeover, a REST auth bypass when the auth attribute is omitted, SQL injection, XXE, SSRF and many missing-authorization bugs. No exploitation has been reported, but older OFBiz bugs have been exploited in the wild.
Why this severity: Apache rates CVE-2026-83542 (unauthenticated RCE) critical; several other pre-auth RCE and auth-bypass bugs in the same release. No known exploitation yet.
- Started
- Nov 4, 2026
Affected
- Apache OFBiz before 24.09.08
Fixed in
- 24.09.08
Timeline2
CVE records are published. CVE-2026-83542 (unauthenticated RCE via login-page widget injection) is rated critical, and CVE-2026-82907 (pre-auth, reusable externalLoginKey session takeover) is rated important.
Apache OFBiz announces 46 CVEs affecting all versions before 24.09.08, including several critical issues, and tells users to upgrade to 24.09.08.
Advisories4
Get an email when a new major security incident drops. No spam, unsubscribe any time.
