CVE-2026-82907

Summary

A capture-replay authentication bypass flaw in Apache OFBiz 24.09 before 24.09.08 allows unauthenticated attackers to reuse captured 'externalLoginKey' values as bearer credentials, granting full session access across all web applications the victim user can reach, without CSRF or authentication checks.

Exploitability

Exploitation is trivial for an attacker who can capture a live externalLoginKey (e.g., via network sniffing, browser compromise, or phishing), requiring no authentication or user interaction.

Blast radius

Successful exploitation grants attackers full session hijacking capabilities across all webapps accessible to the compromised user, enabling complete account takeover and potential lateral movement within the OFBiz environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache OFBiz version 24.09.08 or later, which patches this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.