The vulnerability arises from an incorrect implementation of the authentication algorithm during password‑reset and login JWT validation. When a user follows the prescribed password‑reset flow, the server generates a token that is normally only used to change the password. Instead, the token is mistakenly treated as a full authentication credential. An attacker who obtains a valid password‑reset token can submit it directly to the login endpoint, gaining immediate full access to the account without needing to discover or guess the user’s password. If the account is an administrator, this results in unrestricted administrative control.

The issue exists in Apache OFBiz 24.09 and earlier releases up to but not including 24.09.08. All platform variants of the product are affected. The affected vendor is the Apache Software Foundation.

An attacker must first acquire a password‑reset token, which can be done through email interception, log exposure, or a man‑in‑the‑middle attack on the mail transport. Once the token is in hand, no further privileges are required. Because the token validates as a complete login credential, any user with the token can take over the account instantly. EPSS data is not available and the vulnerability has not been listed in CISA’s KEV catalog, but the lack of a public exploit does not reduce the risk posed to organizations that rely on unencrypted email or otherwise expose the reset tokens.