---
id: CVE-2026-109928
title: >-
  Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password
  Reset Enables Full Account Takeover
summary: >-
  Incorrect Implementation of Authentication Algorithm in the password-reset and
  login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms
  allows an attacker who has obtained a user's password-reset token (via email
  inter…
severity: none
cwe:
  - CWE-303
vendor: Apache Software Foundation
product: Apache OFBiz
affected:
  - apache_ofbiz < 24.09.08
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T13:36:52.802Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109928'
references:
  - url: 'https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.845Z'
---

## Overview

Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure, or a man-in-the-middle on the mail transport) to authenticate as that user and obtain a full, unrestricted session, including administrative access if the targeted account is an administrator, by submitting the token directly to the login endpoint instead of the intended password-change flow. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

## Affected

- `apache_ofbiz < 24.09.08`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.