Vulnerabilities RCE pre-auth in Bonita and OFBiz: 12 critical flaws in enterprise Java

Critical Vulnerabilities in Bonita BPM and Apache OFBiz: Pre-Auth Remote Code Execution

Security researchers at Novee have discovered serious vulnerabilities in Bonita BPM and Apache OFBiz, two widely used enterprise Java platforms, that allow pre-authentication remote code execution. The vulnerabilities were presented at Black Hat USA 2026, highlighting how a single web request can bypass security mechanisms and allow arbitrary code execution on servers.

Bonita BPM: Bypassing Protections and Code Execution

Bonita BPM, used by banks, insurance companies, and government agencies for critical processes such as loan approvals and employee onboarding, has a vulnerability that allows an attacker to access an internal API without authentication. The affected version is 10.4.3.

The attack mechanism exploits three flaws in the protections between the public and internal API surfaces. A single web address can bypass these controls:

• First control: A path segment written as ..; passes the security filter but Tomcat interprets the semicolon as moving up a directory level, routing the request to the internal surface.
• Second control: A fabricated application name in the path satisfies both the authentication filter and the CSRF filter, which stop reading at the matched substring.
• Third control: Protects only direct requests, not those forwarded internally, allowing the request to go unnoticed.

Once inside the internal API, the attacker can exploit the XStream library, which transforms XML into live Java objects, to execute arbitrary code. The attack chain reconstructs a chain of gadgets from Commons Collections classes, bypassing security checks and reaching a Groovy call that executes a command.

Apache OFBiz: Forged Tokens and Code Execution

Apache OFBiz, version 24.09.05, has a critical vulnerability (CVE-2026-31986) that allows unauthenticated remote code execution. The vulnerability exploits a default signing key, present in the public repository, used to sign single sign-on tokens and widget engine callback tokens.

An attacker can:

• Sign a token with the default key, setting the user as admin, thus gaining administrator rights.
• Modify an accessibility preference to enable Groovy execution in the callback token.
• Insert a Groovy command in the token, bypassing a denylist that does not check for uppercase or known prefixes.

This allows arbitrary code execution with two simple unauthenticated GET requests on any OFBiz installation with single sign-on enabled.

Difficulty in Detection and Mitigation

The attack chains are built with components that, individually, seem harmless. A signature scanner has nothing to match, and a generic model might signal a possible deserialization but not prove that the sink is reachable. The exploit lies in how the parts connect.

To prevent similar vulnerabilities, it is essential to:

• Strengthen internal routing as if it were exposed on the Internet.
• Remove unsafe execution primitives.
• Ensure that a rendering preference does not control access to dangerous functions like eval.
• Each component must be defended individually, but it is the connection between them that can lead to unauthorized code execution.

Vendor Response and Recommended Audits

Novee reported all vulnerabilities to the affected projects and collaborated with them before publication. Bonita and OFBiz have released new versions to address the issues.

Organizations using these platforms should:

• Immediately update to the latest versions.
• Conduct thorough security audits of their implementations.
• Monitor internal requests for anomalies.

The vulnerabilities highlight the importance of proactive security measures in enterprise Java applications.