The vulnerability is a hard‑coded cryptographic key that allows an attacker to forge JSON Web Tokens with the system’s default signing key and inject widget templates, resulting in remote code execution. Because the key is fixed and publicly known, an unauthenticated attacker can bypass authentication checks and execute arbitrary code on the host, compromising confidentiality, integrity, and availability.

The flaw affects all installations of Apache OFBiz with a version earlier than 24.09.06. Vendors affected include the Apache Software Foundation, and the product is Apache OFBiz.

The CVSS score is not provided, but the EPSS score is unavailable and the vulnerability is not currently listed in CISA KEV, suggesting no common exploitation in the wild yet. However, because the flaw is unauthenticated and relies on a hard‑coded key that is known by all users, the risk of exploitation remains high. An attacker who can send a forged JWT or inject code into a widget can execute arbitrary commands on the target system. The lack of public exploit may reflect the difficulty or lack of discovery rather than low risk.