What is the CVSS score of CVE-2026-31387?

CVE-2026-31387 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-31387?

Yes, a patch is available for CVE-2026-31387. Update the affected software to the latest version immediately.

Apache OFBiz CVE-2026-31387

EUVD-2026-30869 MEDIUM

Improper Authentication (CWE-287)

2026-05-19 apache

GHSA-3wxm-wq6x-mq3g

Authentication Bypass Apache Apache Ofbiz Apache Software Foundation

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible authentication bypass (AV:N, PR:N, AC:L) with impact limited to partial information disclosure only (C:L, I:N, A:N) and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:54 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:27 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:27 cve.org

MEDIUM 5.3

DescriptionCVE.org

Improper Authentication vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Improper authentication in Apache OFBiz before version 24.09.06 permits unauthenticated remote attackers to bypass authentication controls and access limited confidential information without valid credentials. The flaw (CWE-287) is exploitable over the network with no privilege or user interaction requirements, affecting all OFBiz deployments on unpatched versions. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at 0.02%; however, SSVC marks the attack path as automatable, making it a viable candidate for opportunistic scanning campaigns.

Technical ContextAI

Apache OFBiz is an open-source enterprise resource planning (ERP) framework maintained by the Apache Software Foundation, widely used for order management, accounting, inventory, and customer relationship management. The vulnerability is classified as CWE-287 (Improper Authentication), indicating that one or more authentication enforcement points in the application fail to adequately verify the identity of a requesting party, potentially allowing access to protected resources without valid credentials. The CPE string cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:* covers all versions of the product in the affected range (any version prior to 24.09.06). The CVSS base vector AV:N/AC:L/PR:N/UI:N confirms the flaw resides in a network-exposed code path exercisable at low complexity with no prerequisites, consistent with an authentication-bypass class of defect in a web-facing endpoint.

RemediationAI

Vendor-released patch: upgrade Apache OFBiz to version 24.09.06 as recommended by the Apache Software Foundation advisory at https://lists.apache.org/thread/3wgybgdvmbfvly24zm4sb4y53fc1pqcf. This is the primary and definitive fix. If immediate patching is not feasible, restrict network access to OFBiz administrative and application endpoints via WAF rules or firewall policies, limiting reachability to trusted internal networks or VPN-connected clients only - this mitigates the AV:N exploitation vector but requires careful scope definition to avoid breaking legitimate workflows. Additionally, review application-level access logs for unexpected unauthenticated request patterns to identify any prior exploitation attempts. No workarounds that address the root authentication logic are documented in available references.