Apache OFBiz 24.09.08 fixes a hard-coded JWT key, a password reset takeover and default-open REST auth
Apache OFBiz 24.09.08, announced November 4, fixes a batch of authentication flaws: a hard-coded JWT key giving unauthenticated admin access, a password reset flaw allowing account takeover, a reusable login key not bound to a session and REST operations open by default.
The Apache OFBiz project announced release 24.09.08 on November 4, and many of the fixes are authentication flaws, according to the oss-security announcement. They include CVE-2026-105330, a hard-coded cryptographic key in JWT token authentication that allows unauthenticated administrative access; CVE-2026-109928, an incorrect authentication algorithm in password reset that allows full account takeover; CVE-2026-82907, an externalLoginKey accepted before authentication, reusable and not bound to a session; CVE-2026-92887, where REST API authentication is bypassed by default when an operation omits the auth attribute; CVE-2026-84728, a cross-tenant authorization bypass in mapped-domain login; and CVE-2026-114277, improper binding of Janrain social login identities to local accounts. Every version before 24.09.08 is affected. The Hacker News counts 46 fixes in the release.
Why it matters
The list reads like a catalogue of identity mistakes in one product. A signing key shipped in the code means anyone with the source can mint a valid admin JWT. A login key that is accepted before authentication and not bound to a session is a replayable credential, the token replay pattern. An API that is open unless each operation opts in fails open every time a developer forgets. And a password reset that grants takeover is the account takeover route that skips the login page.
OFBiz is an open-source ERP that often holds customer, order and payment data. Upgrade to 24.09.08, then treat the old state as exposed: invalidate sessions, replace any JWT signing key, review administrator accounts and recent password resets, and check accounts linked through social login for unexpected bindings.
Related on Start with Identity
- BlogLangflow flaws let attackers bypass authentication and run code; only 1.13.0 fixes them
IBM's October 28 bulletin covers four Langflow flaws in every release from 1.0.0 to 1.12.8, including CVE-2026-93680, a 9.8-rated authentication bypass a public
- BlogLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificate
Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate
- BlogNGINX session ticket bug can skip client certificate checks in mTLS setups
CVE-2026-97629 lets a forged TLS session resume on NGINX 1.23.2 through 1.31.6 when a shared session cache is set without a ticket key file, which can bypass cl
- CVEICS JWT auth bypass via hard-coded constants
An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.
- CVEZitadel JWT auth grant ignores key expiration
Zitadel's JWT authorization grant did not check whether the client key had expired. A retired key kept working. Patched by the project.
- GlossaryAuthorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, ci