CVE-2026-31986 - Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz

Apache OFBiz Single Sign-On (SSO) authentication module and signing mechanism

• Affected: Apache OFBiz versions prior to 24.09.06 (e.g., < 24.09.06)

• Fixed: 24.09.06

CVE-2026-31986 is a critical vulnerability stemming from hard-coded cryptographic signing keys embedded directly within the open-source Apache OFBiz code repository. In deployments where Single Sign-On (SSO) is enabled, unauthenticated attackers can leverage these default keys to forge valid administrator SSO authentication tokens. When combined with expression/template parsing behaviors, an unauthenticated remote attacker can execute arbitrary code on the underlying server.

• Hard-Coded Cryptographic Keys (CWE-321): The root flaw lies in the SSO component, where default cryptographic signing keys were checked into public repository source code. Because many production environments deploy software without altering default key configurations, the keys remain predictable across target installations.

• Admin Token Forgery: Using the known static secret keys, an external attacker can locally generate and cryptographically sign a forged SSO session token, granting them immediate administrative privileges without possessing actual account credentials.

• Denylist Bypass to RCE: Upon achieving authenticated access via the forged token, attackers target internal application features (such as template evaluation endpoints). While Apache OFBiz utilized a denylist filter to restrict dangerous Java execution patterns (e.g., checking for terms like java, process, or import), the restriction mechanism was case-sensitive and checked narrow string signatures. Attackers easily bypass this check using alternate letter casing or alternative auto-imported classes to achieve unauthenticated Remote Code Execution (RCE) in as few as two HTTP GET requests.