CVE search · CVE-2026-114277

CVE-2026-114277

medium 6.5

Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2026-11-05
Last changed: 2026-11-10
Source: security@apache.org
Weakness: CWE-302

Severity

Version	Score	Vector	Source
CVSS 3.1	medium 6.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`	134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

apache · ofbiz

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lzMailing ListVendor Advisory

CVE-2026-114277

Details

Severity

Affected products

References