Apache OpenMeetings Uses Hard-coded Cryptographic Key

CAO 7.5CVE-2026-33266 · GHSA-wqxq-w68r-wg85 · Công bố 09/04/2026 · cập nhật 26/10/2026

Tóm tắt nhanh

CVE-2026-33266 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng org.apache.openmeetings:openmeetings-parent, openmeetings (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.30%, cao hơn 22.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 9.0.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.apache.openmeetings:openmeetings-parent Maven	`≥ 6.1.0, < 9.0.0`	`9.0.0`
openmeetings apache	`≥ 6.1.0, < 9.0.0`	`9.0.0`

Mô tả

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.

The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.

This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Mô tả của NVD

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials. This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.