{"id":"CVE-2026-114277","published":"2026-11-05T14:17:01.170","lastModified":"2026-11-05T14:48:26.210","description":"Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz.\nApache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts.\nThis issue affects Apache OFBiz: before 24.09.08.\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-302"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}