CVE-2026-82907: Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 24.09.08
Event History
Frequently Asked Questions
Who is exposed to this issue?
Apache OFBiz deployments running versions before 24.09.08 are affected on all platforms. Any user who can reach a web application can have their session impersonated if a live externalLoginKey issued for that user is captured.
What does an attacker need to exploit it?
The attacker must obtain a live externalLoginKey value. The issue can also cause an authenticated user's key to be sent to an attacker-controlled server when an attacker-chosen absolute URL is used as an inter-application link target.
Is user interaction or an existing attacker account required?
No attacker account or victim interaction is required once a live key has been captured. The captured key is accepted before CSRF and authentication checks as a reusable bearer credential.
What access does a captured key provide?
A captured key provides a complete cookie-free session as the user who issued it, across every OFBiz web application that user can access. The key is not bound to a client, does not expire, and is not invalidated after use.
What is the available remediation?
Upgrade Apache OFBiz to version 24.09.08. This version fixes the issue.