CVE-2026-45434

CVE-2026-45434: Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

Vendor Apache Software Foundation

Product Apache OFBiz

Weakness CWE-287 · Improper authentication

Published May 19, 2026

Last update May 20, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Key dates

02Disclosure timeline

May 19, 2026 CVE published

May 20, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-45434 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html AskarLabs — CWE-287 write-up Improper Authentication

Related vulnerabilities

04Related CVE

CVE-2024-12919 Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id CVE-2026-8994 Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter CVE-2026-48896 Joomla! Core - [20260511] - MFA Authentication Bypass CVE-2025-14002 WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP CVE-2023-48747 WordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification Vulnerability