Read the docs

opencast

Records21All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

opencast records in CISA KEV

No opencast vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Opencast 1 record MEDIUM

Records

21 records

TI-2026-54099 CVE-2026-77615 · GHSA-m6c8-jcw2-5r25

Paella Player: Stored XSS via caption cue text

Priority HIGH 73

Paella Player is a set of libraries to create a multi stream video player.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00559 Published 2026-09-17 Fixed in 19.7, 20.2 +2 CWE-79
TI-2021-19627 CVE-2021-43821 · GHSA-59g4-hpg3-3gcp

Files Accessible to External Parties in Opencast

Priority MEDIUM 46

Opencast is an Open Source Lecture Capture & Video Management for Education.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02029 Published 2021-12-14 Fixed in 10.6 CWE-552
TI-2020-04262 CVE-2020-5206 · GHSA-vmm6-w4cf-7f3x

Authentication Bypass For Endpoints With Anonymous Access in OpenCast

Priority MEDIUM 45

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01293 Published 2020-01-30 Fixed in 7.6, 8.1 CWE-285
TI-2020-04278 CVE-2020-5222 · GHSA-mh8g-hprg-8363

Hard-Coded Key Used For Remember-me Token in OpenCast

Priority MEDIUM 40

Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00939 Published 2020-01-30 Fixed in 7.6, 8.1 CWE-798
TI-2021-19613 CVE-2021-43807 · GHSA-j4mm-7pj3-jf7v

HTTP Method Spoofing in Opencast

Priority LOW 36

Opencast is an Open Source Lecture Capture & Video Management for Education.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01463 Published 2021-12-14 Fixed in 9.10 CWE-290
TI-2020-04286 CVE-2020-5230 · GHSA-w29m-fjp4-qhmq

Opencast uses unsafe identifiers

Priority LOW 36

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.01168 Published 2020-01-30 Fixed in 7.6, 8.1 CWE-99
TI-2020-04285 CVE-2020-5229 · GHSA-h362-m8f2-5x7c

Opencast stores passwords using outdated MD5 hash algorithm

Priority LOW 36

Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00626 Published 2020-01-30 Fixed in 8.1, 7.6 CWE-327
TI-2024-35310 CVE-2024-52797 · GHSA-jh6x-7xfg-9cq2

Searching Opencast may cause a denial of service

Priority LOW 35

Opencast is free and open source software for automated video capture and distribution.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00922 Published 2024-11-21 Fixed in 13.10, 14.3 +1 CWE-770
TI-2020-04284 CVE-2020-5228 · GHSA-6f54-3qr9-pjgj

Opencast allows unauthorized public access via OAI-PMH

Priority LOW 35

Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00977 Published 2020-01-30 Fixed in 7.6, 8.1 CWE-862
TI-2020-04287 CVE-2020-5231 · GHSA-94qw-r73x-j7hg

Opencast users with ROLE_COURSE_ADMIN can create new users

Priority LOW 30

In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00625 Published 2020-01-30 Fixed in 7.6, 8.1 CWE-285
TI-2025-34189 CVE-2025-54380 · GHSA-j63h-hmgw-x4j7

Opencast still publishes global system account credentials

Priority LOW 29

Opencast is a free, open-source platform to support the management of educational audio and video content.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00429 Published 2025-07-26 Fixed in 17.6 CWE-200
TI-2022-20305 CVE-2022-41965 · GHSA-r3qr-vwvg-43f7

Opencast Authenticated OpenRedirect Vulnerability

Priority LOW 27

Opencast is a free, open-source platform to support the management of educational audio and video content.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0039 Published 2022-11-28 Fixed in 12.5 CWE-601
TI-2021-04418 CVE-2021-21318

Removing access may not effect published series

Priority LOW 26

Opencast is a free, open-source platform to support the management of educational audio and video content.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00707 Published 2021-02-18 Fixed in 9.2 CWE-863
TI-2022-11779 CVE-2022-29237 · GHSA-qm6v-cg9v-53j3

Limited Authentication Bypass for Media Files in Opencast

Priority LOW 25

Opencast is a free and open source solution for automated video capture and distribution at scale.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00609 Published 2022-05-24 Fixed in 10.14, 11.7 CWE-287
TI-2025-38181 CVE-2025-61788 · GHSA-m2vg-rmq6-p62r

Opencast Paella Player 7 vulnerable to Cross-Site-Scripting

Priority LOW 23

Opencast is a free, open-source platform to support the management of educational audio and video content.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00217 Published 2025-10-08 Fixed in 17.8, 18.2 CWE-79
TI-2020-16055 CVE-2020-26234 · GHSA-44cw-p2hm-gpf6

Disabled Hostname Verification in OpenCast

Priority LOW 22

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests.

CVSS 3.1MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00279 Published 2020-12-08 Fixed in 7.9, 8.9 CWE-346
Open these records in search →