Back
CVE-2026-114277
Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts
Not scored
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Awaiting Analysis.
- EPSS (exploitation in 30 days)
- Not scored
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Weakness
Affected products
Apache Software Foundation · Apache OFBiz
- affected < 24.09.08
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-114277)Record last updated .