CVE-2026-31986

The vulnerability consists of embedding a hardcoded cryptographic key directly in the Apache OFBiz application source code. Because the key is identical in all installations, a person with knowledge of it (e.g., through source code analysis or previous disclosures) can exploit it without needing to guess it. The attack vector is network-based, requires no authentication or user interaction, which significantly lowers the entry threshold for a potential attacker.

An attacker can gain unauthorized access to protected data (breach of confidentiality) and potentially modify data secured with this key (breach of integrity). According to the CVSS vector, the vulnerability does not directly affect system availability.

Apache OFBiz must be immediately updated to version 24.09.06 or newer, which eliminates the vulnerability. After updating, it is recommended to revoke and rotate the cryptographic keys and certificates that may have been compromised.

Apache OFBiz in all versions before 24.09.06