Pre-auth RCE chains exposed in Bonita BPM and Apache OFBiz

Researchers from Novee disclosed 12 vulnerabilities across four enterprise Java platforms, highlighting two pre-authentication remote code execution chains that affected Bonita BPM 10.4.3 and Apache OFBiz 24.09.05. The findings were presented at Black Hat USA 2026, with Bonita’s chain showing that a single unauthenticated POST request could bypass routing, authentication, and CSRF protections to reach an internal API that deserialized attacker-controlled XML through XStream, resulting in code execution. Novee said the broader audit also uncovered four pre-login flaws and a sandbox escape, but identified Bonita and OFBiz as the most severe cases.

In Apache OFBiz, researchers found that a default signing key exposed in the public source repository allowed attackers to forge JWT-based SSO tokens, impersonate an administrator, and then abuse callback token handling plus Groovy expression evaluation in the widget engine to achieve unauthenticated RCE. The issue, tracked as CVE-2026-31986 and rated Critical, reportedly required SSO to be enabled and could be triggered with only two GET requests. Both vendors released fixes within a standard 90-day disclosure window, while researchers urged organizations to apply updates, replace shared signing keys, normalize paths in authentication and CSRF filters, protect all dispatcher paths, and restrict deserialization and template evaluation features.