PULSE
ENPT
FEED
ransomvexy ransomware reclama a ZipAI · VN · Technologyransomsilentransomgroup reclama a Smith, Gambrell & Russell, LLP · US · Professional Servicesransomsilentransomgroup reclama a W... R...ransomqilin reclama a Insurance Audit Services · US · Financial Servicesransomn0n reclama a Company #137 · CAransomn0n reclama a Company #136 · DKransomn0n reclama a Company #135 · IDransomn0n reclama a Company #134 · USransomn0n reclama a Company #133 · USransomredact reclama a Omni Hotels & Resorts · US · Hospitalityransomakira reclama a Westboro Partnersransomakira reclama a System Plus · Technologyransomakira reclama a David L Wade & Associates · Professional Servicesransomakira reclama a Source Energy Services · CA · Energy & Utilitiesransomvexy ransomware reclama a ZipAI · VN · Technologyransomsilentransomgroup reclama a Smith, Gambrell & Russell, LLP · US · Professional Servicesransomsilentransomgroup reclama a W... R...ransomqilin reclama a Insurance Audit Services · US · Financial Servicesransomn0n reclama a Company #137 · CAransomn0n reclama a Company #136 · DKransomn0n reclama a Company #135 · IDransomn0n reclama a Company #134 · USransomn0n reclama a Company #133 · USransomredact reclama a Omni Hotels & Resorts · US · Hospitalityransomakira reclama a Westboro Partnersransomakira reclama a System Plus · Technologyransomakira reclama a David L Wade & Associates · Professional Servicesransomakira reclama a Source Energy Services · CA · Energy & Utilities
← Todos los CVEs
CVE Watch5 nov 2026

CVE-2026-82907

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote u

CVSS

9.8

Crítico

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 5 nov 2026 · Última mod.: 5 nov 2026 · CWE-294 · CWE-613

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-543758.4 ALT
4.3%
——1VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to read and modify the victim's account or delete the account's authentication record, preventing the legitimate owner from logging in again.14hCVE-2026-1028949.1 CRÍ
17.6%
——5GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.1dCVE-2026-1222207.4 ALT
26.2%
——8WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.9hCVE-2026-121640—
40.7%
——12An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.1dCVE-2026-1217353.7 BAJ
13.9%
——4blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.2dCVE-2024-95174.9 MED
7.7%
——2The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.4d