{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass · updates",
  "home_page_url": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026",
  "feed_url": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026/feed.json",
  "description": "Apache OFBiz 24.09.08 fixes 46 vulnerabilities in every earlier release, several of them critical. Unauthenticated attackers can run code on the server through login-page widget injection (CVE-2026-83542), attacker-controlled Screen definition loading (CVE-2026-68524) and a saved-view authorization bypass (CVE-2026-73578). They can also take over a full user session by replaying a captured externalLoginKey (CVE-2026-82907). On 24.09.06 and 24.09.07 deployments upgraded from older releases, a forged JWT signed with the old default key gives admin access (CVE-2026-105330). The batch also includes a password-reset account takeover, a REST auth bypass when the auth attribute is omitted, SQL injection, XXE, SSRF and many missing-authorization bugs. No exploitation has been reported, but older OFBiz bugs have been exploited in the wild.",
  "language": "en",
  "_pwn": {
    "slug": "apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026#2026-11-05-80c2a5b5",
      "url": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026#2026-11-05-80c2a5b5",
      "title": "Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass: CVE records are published. CVE-2026-83542 (unauthenticated RCE via login-page widget injection) is rated critical, and CVE-2026-82907 (pre-auth, reusable externalLoginKey session takeover) is rated important.",
      "content_text": "Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass: CVE records are published. CVE-2026-83542 (unauthenticated RCE via login-page widget injection) is rated critical, and CVE-2026-82907 (pre-auth, reusable externalLoginKey session takeover) is rated important.\n\nSource: https://www.cve.org/CVERecord?id=CVE-2026-83542",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://www.cve.org/CVERecord?id=CVE-2026-83542",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026#2026-11-04-24f20f7b",
      "url": "https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026#2026-11-04-24f20f7b",
      "title": "Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass: Apache OFBiz announces 46 CVEs affecting all versions before 24.09.08, including several critical issues, and tells users to upgrade to 24.09.08.",
      "content_text": "Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass: Apache OFBiz announces 46 CVEs affecting all versions before 24.09.08, including several critical issues, and tells users to upgrade to 24.09.08.\n\nSource: https://www.openwall.com/lists/oss-security/2026/11/04/9",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.openwall.com/lists/oss-security/2026/11/04/9",
      "tags": [
        "critical"
      ]
    }
  ]
}