---
id: 6166
title: "CVE-2026-45434 — Apache OFBiz LoginWorker checkLogin Password-Change Flow Authentication Bypass RCE"
cve: CVE-2026-45434
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260520-cve-2026-45434-apache-ofbiz-loginworker-checklogin-password-change-flow-authentication-bypass-rce/"
published_at: "2026-05-20T00:00:00Z"
tags: ["rce", "authentication-bypass", "cve-2026-45434", "apache-ofbiz", "groovy"]
phying_url: "https://phying.com/item/6166"
lang: en
---

# CVE-2026-45434 — Apache OFBiz LoginWorker checkLogin Password-Change Flow Authentication Bypass RCE

## Summary

CVE-2026-45434: OFBiz's checkLogin misreads the requirePasswordChange flow as success, letting attackers bypass locked accounts and reach unsandboxed ProgramExport for OS command execution.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-45434
- **Published:** 2026-05-20T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260520-cve-2026-45434-apache-ofbiz-loginworker-checklogin-password-change-flow-authentication-bypass-rce/
- **Phying News:** https://phying.com/item/6166