LDAP injection authentication bypass in Apache OFBiz (CVE-2026-41919)

An LDAP injection vulnerability in Apache OFBiz allows improper neutralization of special elements used in LDAP query DN construction, resulting in an authentication bypass. This issue poses a moderate-severity risk to deployments using LDAP-based authentication. Users are recommended to upgrade immediately to the fixed version. Affected versions: - Apache OFBiz before 24.09.06 We recommend updating to: 24.09.06. CVSS 9.1 · our assessment: act_now Reference: https://lists.apache.org/thread/592czh9o69n74c036vy30fnqknocw74p Details: https://vuln.today/cve/CVE-2026-41919