Hard-coded cryptographic key enabling unauthenticated RCE in Apache OFBiz (CVE-2026-31986)

Apache OFBiz contains a hard-coded cryptographic key used for JWT signing. An unauthenticated attacker can exploit this alongside widget template injection to achieve remote code execution. All versions before 24.09.06 are affected. Affected versions: - Apache OFBiz before 24.09.06 We recommend updating to: 24.09.06. CVSS 9.1 · our assessment: act_now Reference: https://lists.apache.org/thread/2hl9xoqm8tq8b22x6vnmtp7tg3opcqgc Details: https://vuln.today/cve/CVE-2026-31986