Apache OFBiz contains an improper authentication flaw tied to the password‑change logic that lets an attacker bypass standard login checks and gain programmatic control over the system. The issue permits exploitation that can culminate in the execution of arbitrary code on the host. The weakness is identified as a failure to verify authentication, aligning with CWE‑287. This defect undermines confidentiality, integrity, and availability by enabling attackers to launch malicious commands without legitimate credentials.

All installations of Apache OFBiz older than version 24.09.06 are impacted. Users of the Apache Software Foundation’s OFBiz platform before the 24.09.06 release need to consider themselves at risk.

The CVSS score for this vulnerability is 8.8, indicating a high severity, while the EPSS score remains below 1%, suggesting a low but non-zero exploitation probability. The flaw is not included in CISA’s KEV catalog. Based on the description, the likely attack vector is remote: an unauthenticated attacker can craft requests that exploit the password‑change endpoint to trigger the logic flaw. If successful, the attacker may cook up a request that runs arbitrary code, thereby taking full control of the affected system.