Apache OFBiz externalLoginKey Replay Flaw (CVE-2026-82907)

CVE-2026-82907 is an authentication flaw in Apache OFBiz, the open source ERP and e-commerce framework. OFBiz can pass a session token called externalLoginKey between its web applications. The CVE record says the server accepts that key from anyone, so a key that an attacker captures works as a login for the user it was issued to.

The record gives three reasons the key is dangerous. It is never bound to a client, it never expires and it is not invalidated after use. A captured key therefore gives a complete, reusable session without any cookie, in every web application that the user can reach.

Why the Check Comes Too Early

According to the record, the function checkExternalLoginKey runs as a global preprocessor. It runs ahead of both the CSRF check and the authentication check, so a valid key short-circuits the controls that would normally apply.

The record also says the framework itself helps spread the keys. OFBiz appends live keys to every cross-webapp link it renders. Separately, WidgetWorker does not validate the target of an inter-app link. An authenticated user's key can then be attached to an attacker-chosen absolute URL and delivered to the attacker's own server.

How the Score Reads

Apache, the CNA, gives no CVSS score in the record. It rates the issue "important" in a textual severity field. CISA's enrichment, listed by NVD as a secondary source, scores it CVSS 3.1 9.8 Critical with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. There is no CVSS 4.0 score in the record or NVD.

Our reading is that the 9.8 assumes the attacker already holds a live key. The record does not say how likely that is in a given deployment, and the score does not reflect it. NVD shows the entry as undergoing analysis on 5 November 2026.

What Apache, CISA SSVC and KEV Say

The Apache announcement says the release fixes multiple vulnerabilities, "including some critical issues", and tells users to upgrade to 24.09.08. CISA's SSVC record in the CVE entry lists exploitation as none, automatable as yes and technical impact as total, dated 5 November 2026.

As of CISA catalog version 2026.11.04, the CVE is not in the Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains the catalog. The credential at the center of this flaw behaves like the tokens described in our session hijacking entry.

The Other Flaws in the Same Release

The OFBiz security page lists 46 CVEs from 2026 as affecting releases before 24.09.08 and fixed in that release. Apache's announcement gives each a one-line title. Several describe unauthenticated or remote code execution risk, such as CVE-2026-68524 (pre-authentication remote code execution through screen definition loading) and CVE-2026-83542 (unauthenticated remote code execution through login-page widget injection).

Others cover authorization bypasses, path traversal, SQL injection, a hard-coded JWT key (CVE-2026-105330) and a password reset flaw that enables full account takeover (CVE-2026-109928). We have not scored or tested them. One upgrade to 24.09.08 covers the whole list, so the other CVEs are a reason to move quickly, not a separate project.

The CVE record lists Apache OFBiz from version 0 up to but not including 24.09.08, as a semver range, and the description says "24.09 before 24.09.08 on all platforms". Apache's announcement states the affected versions as "all versions prior to 24.09.08". The fix is version 24.09.08.

The sources differ in wording, not in the fix. Because the announcement says "all versions", we recommend treating any OFBiz release older than 24.09.08 as affected, including the 18.12 branch, until Apache says otherwise. The record names no earlier fixed release for this CVE.

The record credits Bartlomiej Dmitruk at striga.ai as the reporter and Krishna Uprit as the remediation developer. Our vulnerability management guide covers how to track a rollout like this, and the patch management entry covers the process.