TI-2020-04262 Aliases CVE-2020-5206 GHSA-vmm6-w4cf-7f3x

Authentication Bypass For Endpoints With Anonymous Access in OpenCast

MEDIUM 45CWE-285Published 2020-01-30 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1

Why it matters now

EPSS 0.01293 70th percentileScored 2026-11-07

Fix Fixed opencast (opencast): 7.6, 8.1org.opencastproject:opencast-kernel (Maven): 7.6, 8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opencast	opencast	before 7.6; 8.0 to before 8.1	7.6, 8.1	Patch available	CNA
—	org.opencastproject:opencast-kernel (Maven)	before 7.6	7.6	Patch available	GHSA-vmm6-w4cf-7f3x
—	org.opencastproject:opencast-kernel (Maven)	8.0 to before 8.1	8.1	Patch available	GHSA-vmm6-w4cf-7f3x

opencast Vendoropencast Affected before 7.6; 8.0 to before 8.1 Fixed in 7.6, 8.1 Patch available CNA
org.opencastproject:opencast-kernel (Maven) Vendor— Affected before 7.6 Fixed in 7.6 Patch available GHSA-vmm6-w4cf-7f3x
org.opencastproject:opencast-kernel (Maven) Vendor— Affected 8.0 to before 8.1 Fixed in 8.1 Patch available GHSA-vmm6-w4cf-7f3x

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apereo:opencast::::::::	before 7.6	Vulnerable	Apereo
cpe:2.3:a:apereo:opencast:8.0:::::::*	8.0	Vulnerable	Apereo

cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 7.6 Vulnerable ·Apereo
cpe:2.3:a:apereo:opencast:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Apereo

Remediation

Fix · CNA opencast (opencast) Fixed in 7.6, 8.1
Fix · GHSA-vmm6-w4cf-7f3x org.opencastproject:opencast-kernel (Maven) Fixed in 7.6 Advisory →
Fix · GHSA-vmm6-w4cf-7f3x org.opencastproject:opencast-kernel (Maven) Fixed in 8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-5206
2026-10-03 Alias added: GHSA-vmm6-w4cf-7f3x

References

Patch 1

https://github.com/opencast/opencast/commit/b157e1fb3b35991ca7bf59f0730329fbe7ce82e8

Advisory 2

TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8
TI-2020-04278 Hard-Coded Key Used For Remember-me Token in OpenCast CVSS 3.1HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences