Apache OFBiz CVE-2026-82907

Exploitation targets OFBiz's externalLoginKey, the token used to carry an authenticated session across OFBiz webapps via request parameters. The prerequisite is obtaining a valid key: because it travels in URLs it can leak through Referer headers, proxy/web-server access logs, or browser history. The flaw conditions stated in the advisory are that the key is accepted pre-authentication, is reusable (not single-use/invalidated), and is unbound (not tied to the originating session, IP, or user agent), so a captured key can be replayed to assume that user's access. The principal limiting factor is that the attacker must first capture a live key; the key's entropy, lifetime, and the precise request path are not described in the available sources, so the practical difficulty of capture is unverified.

This entry is one vulnerability (externalLoginKey honoured pre-auth, reusable and unbound) within a large bulk Apache OFBiz advisory fixed in 24.09.08. Key prioritization signals are missing: no CVSS vector, EPSS score, or SSVC exploitation/automatable/technical-impact values are provided, and the vuln.today decision label is explicitly 'awaiting_data', so no authoritative severity can be cited. It is not listed in CISA KEV and no proof-of-concept or exploit reference is supplied, so there is no public exploit identified at time of analysis. On mechanism alone the issue is serious: externalLoginKey is OFBiz's cross-webapp SSO token, and if it is accepted before authentication, can be replayed, and is not bound to a session/IP/user, then a captured key yields the associated user's authenticated access - effectively a session-hijack/authentication-bypass primitive. However, real-world risk hinges on how easily a valid key is obtained and on its entropy and lifetime, which the bulk advisory does not describe, so severity here is INFERRED from the one-line title, not confirmed by a vendor CVSS. Because authentication requirements cannot be drawn from a CVSS vector (none provided), the pre-auth claim rests on the advisory title text only and should be verified against the per-CVE Apache advisory.

An attacker obtains a valid externalLoginKey - for example from a Referer header, a reverse-proxy or web-server access log, or browser history, since OFBiz carries this token in request URLs - and replays it against the OFBiz instance. Because the key is honoured pre-authentication, is reusable rather than single-use, and is not bound to the original session, IP, or user agent, the replayed key grants the legitimate user's authenticated session. No public exploit code is identified at time of analysis; the exact trigger and key-capture path are not detailed in the available bulk advisory.