CVE-2026-82907
CRITICALDescription
Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Is your site exposed to CVE-2026-82907?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| apache | ofbiz |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2026-82907? +
How severe is CVE-2026-82907? +
What products are affected by CVE-2026-82907? +
How do I check if I'm vulnerable to CVE-2026-82907? +
Related Vulnerabilities
Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key …
Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the …
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the …
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a …
A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process …
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML …
