# Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass · pwn.watch > Apache OFBiz 24.09.08 fixes 46 vulnerabilities in every earlier release, several of them critical. Unauthenticated attackers can run code on the server through login-page widget injection (CVE-2026-83542), attacker-controlled Screen definition loading (CVE-2026-68524) and a saved-view authorization bypass (CVE-2026-73578). They can also take over a full user session by replaying a captured externalLoginKey (CVE-2026-82907). On 24.09.06 and 24.09.07 deployments upgraded from older releases, a forged JWT signed with the old default key gives admin access (CVE-2026-105330). The batch also includes a password-reset account takeover, a REST auth bypass when the auth attribute is omitted, SQL injection, XXE, SSRF and many missing-authorization bugs. No exploitation has been reported, but older OFBiz bugs have been exploited in the wild. Page: https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026 · generated 2026-11-05T22:12:55.010Z ## Status - Severity: critical · status: live · patch: patched - Product: Apache OFBiz - Started: 2026-11-04 - CVEs: CVE-2026-83542, CVE-2026-68524, CVE-2026-73578, CVE-2026-82907, CVE-2026-105330, CVE-2026-109928, CVE-2026-92887 - Affected: Apache OFBiz before 24.09.08 - Fixed in: 24.09.08 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026.json - This file: https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026/llms.txt ## Updates (newest first) - 2026-11-05: CVE records are published. CVE-2026-83542 (unauthenticated RCE via login-page widget injection) is rated critical, and CVE-2026-82907 (pre-auth, reusable externalLoginKey session takeover) is rated important. (https://www.cve.org/CVERecord?id=CVE-2026-83542) - 2026-11-04: Apache OFBiz announces 46 CVEs affecting all versions before 24.09.08, including several critical issues, and tells users to upgrade to 24.09.08. (https://www.openwall.com/lists/oss-security/2026/11/04/9) ## Fix brief # Security brief: Apache OFBiz 24.09.08 fixes 46 CVEs, including unauthenticated RCE and login bypass Source: https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026 · status: live · severity: critical · updated Nov 5, 2026, 20:10 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Apache OFBiz 24.09.08 fixes 46 vulnerabilities in every earlier release, several of them critical. Unauthenticated attackers can run code on the server through login-page widget injection (CVE-2026-83542), attacker-controlled Screen definition loading (CVE-2026-68524) and a saved-view authorization bypass (CVE-2026-73578). They can also take over a full user session by replaying a captured externalLoginKey (CVE-2026-82907). On 24.09.06 and 24.09.07 deployments upgraded from older releases, a forged JWT signed with the old default key gives admin access (CVE-2026-105330). The batch also includes a password-reset account takeover, a REST auth bypass when the auth attribute is omitted, SQL injection, XXE, SSRF and many missing-authorization bugs. No exploitation has been reported, but older OFBiz bugs have been exploited in the wild. Severity detail: Apache rates CVE-2026-83542 (unauthenticated RCE) critical; several other pre-auth RCE and auth-bypass bugs in the same release. No known exploitation yet. - Product: Apache OFBiz - CVE / advisory ids: CVE-2026-83542, CVE-2026-68524, CVE-2026-73578, CVE-2026-82907, CVE-2026-105330, CVE-2026-109928, CVE-2026-92887 ## Affected versions - Apache OFBiz before 24.09.08 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 24.09.08 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Upgrade every Apache OFBiz instance to 24.09.08. Until then, keep OFBiz off the public internet. If you came to 24.09.06 or 24.09.07 from an older release, also set a new random security.token.key and check that no external login keys or sessions are still valid. ## Latest updates - Nov 5, 2026: CVE records are published. CVE-2026-83542 (unauthenticated RCE via login-page widget injection) is rated critical, and CVE-2026-82907 (pre-auth, reusable externalLoginKey session takeover) is rated important. - Nov 4, 2026: Apache OFBiz announces 46 CVEs affecting all versions before 24.09.08, including several critical issues, and tells users to upgrade to 24.09.08. ## Advisories - [Apache OFBiz: CVE Announcements](https://www.openwall.com/lists/oss-security/2026/11/04/9) (Apache OFBiz (oss-security)) - [Apache OFBiz security: list of known vulnerabilities](https://ofbiz.apache.org/security.html) (Apache OFBiz) - [CVE-2026-83542](https://www.cve.org/CVERecord?id=CVE-2026-83542) (CVE) - [CVE-2026-82907](https://www.cve.org/CVERecord?id=CVE-2026-82907) (CVE) --- Machine-readable: https://pwn.watch/i/apache-ofbiz-24-09-08-unauthenticated-rce-auth-bypass-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.