CVE-2026-31387 - Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation

Back Back to CVE browser

MEDIUM

Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation

Published May 19, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

Improper Authentication vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Affected products

Vendor Apache Software Foundation Product Apache OFBiz Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <24.09.06

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache OFBiz

unaffected

Version	Status	Constraints
0	affected	<24.09.06

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

http://www.openwall.com/lists/oss-security/2026/05/19/20
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30869
Advisory
https://lists.apache.org/thread/3wgybgdvmbfvly24zm4sb4y53fc1pqcf
vendor-advisoryMailing ListVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/05/19/20
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30869		Advisory
https://lists.apache.org/thread/3wgybgdvmbfvly24zm4sb4y53fc1pqcf		vendor-advisoryMailing ListVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apache

Published May 19, 2026

Updated May 19, 2026

Reserved Mar 9, 2026

Link CVE-2026-31387

CISA Vulnrichment

Updated May 19, 2026

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2026-31387

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-31387

ENISA EUVD

Assigner apache

Published May 19, 2026

Updated May 19, 2026

Exploited since n/a

Link EUVD-2026-30869

EUVD-2026-30869