Apache OFBiz 24.09.06 and 24.09.07 contain a hard‑coded cryptographic key that is used to sign JSON Web Tokens. An attacker can construct a forged JWT signed with this factory‑default key, bypassing authentication and gaining unrestricted administrative access to the system. The weakness is a static key configuration flaw. This falls under the input validation and cryptographic misuse class identified by CWE‑321.

The vulnerability applies to deployments of Apache OFBiz released before 24.09.08 that use the security.token.key value set to the default factory key. It specifically affects 24.09.06 and 24.09.07 on all operating platforms, and any upgrade from a release older than CVE‑2026‑31986 that preserves the old security.properties file with security.internal.sso.enabled set to true. Versions 24.09.08 and newer have the hard‑coded key removed, but upgrades of existing installations must run the rotateSecretKeys task to replace the persistent key.

The attacker must be able to send requests to the OFBiz application over the network; no local privilege escalation is required. Because the key is known, forging a JWT is trivial and does not require any interaction beyond possessing network connectivity. The lack of an EPSS score means the exploitation probability is unknown, but the presence of a full administrative bypass implies a severe impact. The vulnerability is not listed in CISA KEV, yet the potential for high‑privilege account takeover makes it a high‑priority issue.