Authentication Bypass via Capture-Replay in OFBiz ExternalLoginKeysManager

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-82907 represents a critical authentication bypass vulnerability in Apache OFBiz 24.09 prior to patch 24.09.08 that allows unauthenticated attackers to hijack user sessions through capture-replay attacks. The vulnerability exists in the ExternalLoginKeysManager's checkExternalLoginKey function, which processes external login keys as bearer credentials before CSRF and authentication checks are evaluated. An attacker who captures a single externalLoginKey value in transit can reuse it indefinitely to impersonate the originating user across all webapps accessible to that user, requiring no cookie manipulation or additional exploitation. This affects all platforms running vulnerable OFBiz versions and poses immediate risk to organizations using OFBiz for identity and access management, as session hijacking at this scale can lead to complete account takeover and lateral movement through enterprise systems.

Casky's 283 matched security skills, powered by Claude's extended reasoning capabilities, detect the attack patterns associated with this vulnerability by mapping to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky will observe findings related to: (1) improper authentication flow sequencing—detecting when authentication checks execute after credential acceptance rather than before; (2) credential bearer token reuse patterns—identifying static, non-session-bound tokens being accepted across multiple requests and applications; (3) bypass of security controls—flagging scenarios where CSRF protections and rate-limiting are circumvented by preprocessor-level acceptance of credentials. The platform's skill set enables detection of reconnaissance activities (scanning for externalLoginKey exposure), exploitation attempts (replay of captured keys), and post-exploitation lateral movement, allowing security teams to identify compromised sessions and trace attacker movement through their OFBiz infrastructure before widespread damage occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82907.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-82907

Casky has 283 skills that investigate the attack patterns behind CVE-2026-82907. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn