CVE-2026-45434

The CVSS 9.8 score on this Apache OFBiz authentication bypass reflects maximum theoretical severity, but the EPSS probability of 22% tells a more nuanced story that practitioners must weigh against operational reality. This is an improper authentication vulnerability residing in password-change logic — not a pre-auth remote code execution. An attacker must first reach the password-change endpoint, which typically requires valid credentials or a separate account takeover vector. This authentication barrier is the critical factor the CVSS vector understates; the score treats authentication as a footnote while the description makes it the core mechanism. The EPSS score reflects this complexity. Exploitation likelihood depends on whether your OFBiz instance is internet-facing, whether default or weak credentials exist, and whether the password-change endpoint accepts unauthenticated requests in your deployment configuration. Patch to 24.09.06 exists, but absence of public IOCs suggests this isn't yet mass-exploited. One context that neither metric captures: this is an ERP system, not a typical web app. OFBiz serves as the financial brain for organizations — order data, payment rails, supplier relationships, and transaction logic all flow through it. A successful exploit creates downstream supply chain exposure and regulatory liability that exceeds typical RCE impact. The 24.09.06 version jump itself is notable; such increments in OFBiz CVE history often indicate accumulated authentication debt where multiple related bypass vectors surface together. Verify your deployment: is OFBiz internet-exposed, and does the password-change endpoint permit unauthenticated access? If so, prioritize patching. If internal-only with strong credential policies, the EPSS 22% probability may better reflect actual risk — but the ERP consequence ceiling means any exploitation is high-impact regardless of likelihood.

Reviewed through automated stages and approved by a human before publication.