Executive brief
Apache OFBiz, an open-source enterprise resource planning (ERP) system, contains a security flaw where it uses a fixed, publicly known password for its encryption processes. This could allow an unauthorized person to decrypt sensitive data or bypass security controls that rely on these keys. Organizations should update to version 24.09.06 to ensure unique, secure keys are used instead.
Technical details
A vulnerability exists in Apache OFBiz (before version 24.09.06) classified as CWE-321: Use of Hard-coded Cryptographic Key. The software utilizes a static, pre-defined key for cryptographic operations rather than generating a unique or secure secret during deployment. An attacker with knowledge of this hard-coded key could potentially decrypt sensitive information, forge authentication tokens, or perform other unauthorized actions depending on where the key is utilized within the framework. The issue is resolved in version 24.09.06 by ensuring cryptographic keys are no longer hard-coded.
Affected products
- Apache OFBiz versions before 24.09.06
Timeline
- 2026-05-19: disclosed
- 2026-05-19: advisory