CVE-2026-105330

{
  "etk_id": "ETK-2026-3629",
  "cve_id": "CVE-2026-105330",
  "display_id": "CVE-2026-105330",
  "ghsa_id": "GHSA-3hmp-vj9f-wrxh",
  "euvd_id": "EUVD-2026-117524",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hard-coded JWT key authentication bypass in Apache OFBiz",
  "summary": "Apache OFBiz 24.09.06 and 24.09.07 can retain a default JWT signing key in upgraded deployments. An unauthenticated network attacker could use that condition to gain administrative access when internal SSO is enabled and the prior security configuration was preserved.",
  "mitigation": "Upgrade Apache OFBiz to 24.09.08. If the deployment retained security.properties from before the earlier key-generation fix, run `./gradlew rotateSecretKeys` after upgrading.",
  "vendor": "Apache Software Foundation",
  "product": "Apache OFBiz",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 24.09.06, < 24.09.08"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "24.09.08"
      ],
      "package_name": "Apache OFBiz",
      "purl": null
    }
  ],
  "cwes": [
    321
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 29.5432609,
  "t0_at": "2026-11-05T13:40:03.111000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-05T14:15:32.005338+00:00",
      "days": 0.02463998076388889,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T13:40:03.111000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-05T13:40:03.111000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T13:40:03.111000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105330"
    }
  }
}