An improper authentication flaw in Apache OFBiz allows an attacker with a valid authenticated session to manipulate session cookies and forge JSON‑Web Tokens (JWTs). By tampering with the token, the attacker can impersonate other user accounts and gain unauthorized access to sensitive functions or data. The weakness is a classic authentication bypass (CWE‑287).

Apache OFBiz versions released before 24.09.06 are vulnerable. Systems running those earlier releases must verify whether the vulnerability applies to their configuration.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of < 1% suggests a low likelihood of exploitation; it is not listed in the CISA KEV catalog. However, the attack requires only authenticated access and basic cookie manipulation, which is straightforward for a malicious actor who has compromised a user account. Given the potential for full account impersonation, the risk remains significant until the product is updated or mitigated.