Apache OFBiz CVE-2026-114277

Exploitation requires the Janrain Engage social-login integration to be configured and enabled in the OFBiz deployment - this is an optional, non-default authentication component (and Janrain Engage itself is a discontinued third-party service), so deployments not using social login are not exposed. The specific prerequisites for forcing the improper external-identity-to-local-account binding are not described in the available sources, so authentication level and required user interaction cannot be confirmed from the input. The limiting factor is clear: only installations that have deliberately enabled Janrain Engage social login are affected; all other OFBiz configurations are out of scope for this issue.

No CVSS vector, EPSS score, KEV listing, SSVC automatability/technical-impact rating, or POC reference is supplied for CVE-2026-114277; the only decision signal is vuln.today's priority label 'awaiting_data', meaning the data needed to prioritize this is not yet available. The flaw is one entry in a large batch Apache OFBiz advisory and concerns the Janrain Engage social-login integration improperly binding an external (social) identity to a local OFBiz account - a class of flaw that, if the binding can be forced, points to authentication bypass or account takeover rather than mere information disclosure. Because no severity metrics are provided, I cannot confirm attack vector, complexity, or privilege requirements from the input, and the exact trigger is not described in the available sources; the risk below is an independent assessment, not a vendor- or NVD-confirmed rating. Weighing it as a likely network-reachable identity-binding defect in an optional, now-deprecated social-login component, this is a plausibly serious integrity/confidentiality issue but one whose real-world priority is currently indeterminate pending CVSS/EPSS data and confirmation of exploitability. There is no evidence of active exploitation and no public exploit identified for this specific CVE.

An attacker interacts with an OFBiz deployment that has the Janrain Engage social-login feature enabled and abuses the flawed identity-to-account binding so that an externally controlled social identity is associated with a local account the attacker should not control, yielding authenticated access. The precise trigger sequence is not described in the available sources, and no public exploit has been identified for this CVE.