A remote unauthenticated attacker can capture a live externalLoginKey in Apache OFBiz 24.09 before 24.09.08 and reuse it without cookies to impersonate the issuing user across all web applications. The key is accepted by the global preprocessor before CSRF and authentication checks, acting as a bearer credential that is never bound to a client, never expires, and is not invalidated after use. Apache OFBiz also automatically appends live keys to cross‑web‑app links and allows a user‑issued key to be attached to an arbitrary URL, which can be delivered to an attacker's server, creating a complete, cookie‑free session as the target user.

Apache OFBiz version 24.09 on all platforms, prior to the 24.09.08 release. Any component that uses the ExternalLoginKeysManager for authentication is vulnerable.

The CVSS score of 9.8 indicates severe risk, and EPSS data is missing, but the capability for an unauthenticated attacker to capture and reuse an externalLoginKey across multiple web apps presents a high exploitation risk. The attack vector is remote through the web interface, requiring interception of an active key—achievable via sniffing, phishing, or exploitation of the framework's link handling. Once captured, the attacker gains immediate session hijack capabilities.