Apache OFBiz CVE-2026-109928

The attacker must first obtain a valid password-reset token for the target account - the description names three concrete acquisition paths: interception of the reset email, exposure of the token in logs, or a man-in-the-middle on the mail transport. The flaw is then triggered by submitting that token directly to the login endpoint (instead of the password-change flow), where the incorrect JWT validation accepts it as a login credential. Limiting factors: exploitation is impossible without out-of-band token capture (hence CVSS AC:H), it is confined to Apache OFBiz 24.09 releases before 24.09.08, and administrative impact only occurs when the compromised account is itself an administrator.

This is a genuine but conditional priority rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4 High) reflects full account takeover with confidentiality and integrity impact, but the AC:H flag is meaningful: exploitation is gated on the attacker first obtaining a victim's password-reset token out-of-band. The supporting signals point to low near-term volume - EPSS is 0.19% (9th percentile), the CVE is NOT on CISA KEV, and no SSVC/automatable or active-exploitation flag is present. The vuln.today decision label is 'this_week,' consistent with a real but not emergency-grade fix window. There is no verified exploit code: the references are an oss-security advisory and vendor/NVD mailing-list links, not a working PoC. Note one tension to verify: CVSS scores this PR:N (no attacker privileges needed), yet the description makes clear a valid password-reset token is a hard prerequisite - so 'unauthenticated' in the CVSS sense does not mean condition-free. Net: patch promptly, especially for internet-exposed OFBiz instances and any deployment where reset tokens could traverse untrusted mail paths, but widespread opportunistic exploitation is not indicated by the current data.

An attacker who intercepts a legitimate user's password-reset token - for example via email interception, exposure in logs, or a man-in-the-middle on the mail transport - submits that token directly to the login endpoint instead of the intended password-change flow. Because JWT validation is implemented incorrectly, OFBiz accepts the reset token as a login credential and issues a full, unrestricted session; if the victim is an administrator, the attacker gains administrative access. No public exploit code is identified at time of analysis, and the high attack complexity reflects the need to first obtain a valid reset token.