The vulnerability allows an unauthenticated attacker to send arbitrary tenant IDs to the ContextFilter and LoginWorker in a multitenant OFBiz deployment. The system builds a delegator name from the supplied userTenantId and caches it in DelegatorFactory without confirming the tenant exists. Because the cache retains entries for non‑existent tenants, an attacker can flood the system with unique IDs, causing the cache to grow without bound and generating excessive memory consumption and database load, leading to a denial of service. This is a classic resource‑exhaustion weakness (CWE‑400) and resource leak (CWE‑770).

The flaw affects Apache OFBiz in multitenant mode. It applies to any installation where the ContextFilter and LoginWorker processes userTenantId parameters from unauthenticated requests. No specific version is listed, so all current releases that expose the same code path are potentially vulnerable.

The EPSS score is not available and the entry is not listed in the CISA KEV catalog, but the described attack can be executed without authentication and requires only the ability to send HTTP requests to the login endpoint. An attacker with network access to the application can easily enumerate arbitrary tenant IDs, triggering continuous cache growth and resource drain. The lack of authentication and the direct use of the input in cache key construction make the exploit straightforward and likely to succeed, especially on exposed deployments.