PT-2026-41857 · Apache · Apache Ofbiz

Zhaokaifei · Published 2026-05-19 · Updated 2026-05-19 · CVE-2026-41919

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.06

Description Improper Neutralization of Special Elements used in an LDAP Query, also known as LDAP Injection, allows for authentication bypass due to improper neutralization of LDAP special elements in DN construction. LDAP Injection occurs when an application fails to properly sanitize user-supplied input before using it in a Lightweight Directory Access Protocol (LDAP) query, potentially allowing an attacker to manipulate the query logic.

Recommendations Upgrade to version 24.09.06.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-41919

Affected Products

Apache Ofbiz

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-41919 · Security Note
• https://lists.apache.org/thread/592czh9o69n74c036vy30fnqknocw74p · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/05/19/27 · Note
• https://t.me/CVEtracker/54222 · Telegram Post