---
id: CVE-2026-114277
title: >-
  Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities
  to Local Accounts
summary: >-
  Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz.

  Apache OFBiz's optional Janrain Engage Social Login integration in the
  ecommerce component improperly binds authenticated external identities to
  local user ac…
severity: none
cwe:
  - CWE-302
vendor: Apache Software Foundation
product: Apache OFBiz
affected:
  - apache_ofbiz < 24.09.08
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T13:33:35.761Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114277'
references:
  - url: 'https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.841Z'
---

## Overview

Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz.
Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue.

## Affected

- `apache_ofbiz < 24.09.08`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.