Loading vulnerability…
Authentication Bypass in Apache OFBiz Janrain Engage Social Login
Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the ecommerce component's optional Janrain Engage Social Login integration. The integration improperly binds authenticated external identities to local user accounts, potentially allowing an attacker to authenticate as a local user without that user's credentials.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow unauthorized access to a local user account through the social login integration. The resulting access would depend on the permissions of the affected account; administrative access or code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Pending upgrade, disable the optional Janrain Engage Social Login integration if enabled. No other interim workaround is specified.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes the improper identity-to-account binding.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.