# Apache OFBiz 24.09.08 fixes a hard-coded JWT key, a password reset takeover and default-open REST auth

Source: https://startwithidentity.com/blog/2026-11-04-apache-ofbiz-24-09-08-fixes-a-hard-coded-jwt-key-and-a-password-reset-account-takeover/
Last updated: 2026-11-04
License: content by Start with Identity. Cite the source URL.

---

The Apache OFBiz project announced release 24.09.08 on November 4, and many of the fixes are authentication flaws, according to the [oss-security announcement](https://www.openwall.com/lists/oss-security/2026/11/04/9). They include CVE-2026-105330, a hard-coded cryptographic key in JWT token authentication that allows unauthenticated administrative access; CVE-2026-109928, an incorrect authentication algorithm in password reset that allows full account takeover; CVE-2026-82907, an externalLoginKey accepted before authentication, reusable and not bound to a session; CVE-2026-92887, where REST API authentication is bypassed by default when an operation omits the auth attribute; CVE-2026-84728, a cross-tenant authorization bypass in mapped-domain login; and CVE-2026-114277, improper binding of Janrain social login identities to local accounts. Every version before 24.09.08 is affected. [The Hacker News](https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html) counts 46 fixes in the release.

## Why it matters

The list reads like a catalogue of identity mistakes in one product. A signing key shipped in the code means anyone with the source can mint a valid admin [JWT](https://startwithidentity.com/glossary/jwt/). A login key that is accepted before authentication and not bound to a session is a replayable credential, the [token replay](https://startwithidentity.com/techniques/token-replay-unbound-endpoint/) pattern. An API that is open unless each operation opts in fails open every time a developer forgets. And a password reset that grants takeover is the [account takeover](https://startwithidentity.com/glossary/account-takeover/) route that skips the login page.

OFBiz is an open-source ERP that often holds customer, order and payment data. Upgrade to 24.09.08, then treat the old state as exposed: invalidate sessions, replace any JWT signing key, review administrator accounts and recent password resets, and check accounts linked through [social login](https://startwithidentity.com/glossary/social-login/) for unexpected bindings.

Source: [oss-security (Apache OFBiz)](https://www.openwall.com/lists/oss-security/2026/11/04/9), [The Hacker News](https://thehackernews.com/2026/11/threatsday-apache-ofbiz-rce-dreamhost.html)