CVE-20XX-?

CVE-2026-114277

unscored Fix listed Auth & access Web app

What it is

Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

At a glance

Fix
A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

  1. PublishedDisclosed publicly on CVE.org and NVD
  2. Last updatedMost recent change to the record

Details

Published
Last modified
Weakness
CWE-302
Record status
Undergoing Analysis
Meme: I wake up, CVE-2026-114277
Download Square Reddit

References

NVD record · CVE.org record