CVE Intelligence
Analysis AI-assisted

CVE-2026-41919: Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

CVE-2026-41919 is an LDAP Injection issue (CWE-90) in Apache OFBiz versions before 24.09.06. The record carries a CVSS 3.1 base score of 9.1 (Critical) and its title describes the consequence as an authentication bypass. The record states that upgrading to 24.09.06 fixes the issue, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Apache OFBiz is affected by a vulnerability classified as LDAP Injection (CWE-90), described as improper neutralization of special elements used in an LDAP query. The record title characterizes the consequence as an authentication bypass caused by improper neutralization of LDAP special elements in DN construction.

Impact

  • The recorded CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, with a base score of 9.1 (Critical).
  • The vector indicates high confidentiality and integrity impact, no availability impact, network attack vector, and no privileges or user interaction required.
  • The SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

  • Product: Apache Software Foundation OFBiz.
  • Affected: versions before 24.09.06.
  • Fixed: 24.09.06, according to the record description. The structured fixes field in the record is empty, so the fixed version is taken from the description text.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC exploitation field is recorded as none.
  • The EPSS probability is 0.0059, with a percentile of 0.47528.

Remediation and mitigation

  • Upgrade Apache OFBiz to version 24.09.06 or a later release, as recommended in the project's advisory.
  • Prioritize internet-exposed deployments and those that rely on LDAP-based authentication, given the critical score.
  • The record does not list any workaround. If an upgrade is delayed, consult the project's advisory channels for interim guidance.

Detection guidance

  • Maintain an inventory of OFBiz instances and their versions to identify those below 24.09.06.
  • Review authentication logs for unexpected successful logins or anomalous authentication activity at a high level.
  • Monitor the project's mailing list and the GitHub advisory for updates.

Limitations of the available information

  • The record does not describe the vulnerable code path, configuration prerequisites, or the exact authentication flow affected. This is unknown from the available data.
  • The structured fixes list is empty, so the fixed version relies on the description text.
  • Whether a specific deployment is exposed depends on its configuration, which the record does not describe.
  • The EPSS date in the record is later than the publication date; the score is reported as recorded.

Sources: NVD entry, Apache mailing list thread, GitHub advisory.

Frequently asked questions

What is CVE-2026-41919?

It is an LDAP Injection vulnerability (CWE-90) in Apache OFBiz. The record describes improper neutralization of special elements in an LDAP query and its title refers to an authentication bypass.

Which versions are affected?

The record lists Apache OFBiz versions before 24.09.06 as affected. The description says upgrading to 24.09.06 fixes the issue.

Is this vulnerability known to be exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as none.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.