{"affected":[{"defaultStatus":"unaffected","product":"Apache OFBiz","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"24.09.08","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-114277","cwes":["CWE-302"],"description":"Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz.\nApache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts.\nThis issue affects Apache OFBiz: before 24.09.08.\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793885615761,"publishedAt":1793885615761,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"}],"remediation":[],"revision":"9f6395cc85cf49be671befd71ba918df308f95bd05360d44403b173b82e2c35d","sources":[{"modifiedAt":1793885615761,"name":"CNA: apache","retrievedAt":1793887750683,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114277"}],"ssvc":null,"status":"published","title":"Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local Accounts","updatedAt":1793887750683}