Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass ยท updates https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026 Apache OFBiz 24.09.08 fixes 46 vulnerabilities in every earlier release, several of them critical. Unauthenticated attackers can run code on the server through login-page widget injection (CVE-2026-83542), attacker-controlled Screen definition loading (CVE-2026-68524) and a saved-view authorization bypass (CVE-2026-73578). They can also take over a full user session by replaying a captured externalLoginKey (CVE-2026-82907). On 24.09.06 and 24.09.07 deployments upgraded from older releases, a forged JWT signed with the old default key gives admin access (CVE-2026-105330). The batch also includes a password-reset account takeover, a REST auth bypass when the auth attribute is omitted, SQL injection, XXE, SSRF and many missing-authorization bugs. No exploitation has been reported, but older OFBiz bugs have been exploited in the wild. en Thu, 05 Nov 2026 00:00:00 GMT Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass: CVE records are published. CVE-2026-83542 (unauthenticated RCE via login-page widget injection) is rated critical, and CVE-2026-82907 (pre-auth, reusable externalLoginKey session takeover) is rated important. https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026 https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026#2026-11-05-80c2a5b5 Thu, 05 Nov 2026 00:00:00 GMT critical <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-83542">Source</a></p> Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass: Apache OFBiz announces 46 CVEs affecting all versions before 24.09.08, including several critical issues, and tells users to upgrade to 24.09.08. https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026 https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026#2026-11-04-24f20f7b Wed, 04 Nov 2026 00:00:00 GMT critical <p><a href="https://www.openwall.com/lists/oss-security/2026/11/04/9">Source</a></p>