TI-2020-04278 Aliases CVE-2020-5222 GHSA-mh8g-hprg-8363

Hard-Coded Key Used For Remember-me Token in OpenCast

MEDIUM 40CWE-798Published 2020-01-30 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-798.

Summary

Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1

Why it matters now

EPSS 0.00939 61st percentileScored 2026-11-07

Fix Fixed opencast (opencast): 7.6, 8.1org.opencastproject:opencast-kernel (Maven): 7.6, 8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opencast	opencast	before 7.6; 8.0 to before 8.1	7.6, 8.1	Patch available	CNA
—	org.opencastproject:opencast-kernel (Maven)	before 7.6	7.6	Patch available	GHSA-mh8g-hprg-8363
—	org.opencastproject:opencast-kernel (Maven)	8.0 to before 8.1	8.1	Patch available	GHSA-mh8g-hprg-8363

opencast Vendoropencast Affected before 7.6; 8.0 to before 8.1 Fixed in 7.6, 8.1 Patch available CNA
org.opencastproject:opencast-kernel (Maven) Vendor— Affected before 7.6 Fixed in 7.6 Patch available GHSA-mh8g-hprg-8363
org.opencastproject:opencast-kernel (Maven) Vendor— Affected 8.0 to before 8.1 Fixed in 8.1 Patch available GHSA-mh8g-hprg-8363

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apereo:opencast::::::::	before 7.6	Vulnerable	Apereo
cpe:2.3:a:apereo:opencast:8.0:::::::*	8.0	Vulnerable	Apereo

cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 7.6 Vulnerable ·Apereo
cpe:2.3:a:apereo:opencast:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Apereo

Remediation

Fix · CNA opencast (opencast) Fixed in 7.6, 8.1
Fix · GHSA-mh8g-hprg-8363 org.opencastproject:opencast-kernel (Maven) Fixed in 7.6 Advisory →
Fix · GHSA-mh8g-hprg-8363 org.opencastproject:opencast-kernel (Maven) Fixed in 8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-5222
2026-10-03 Alias added: GHSA-mh8g-hprg-8363

References

Patch 1

https://github.com/opencast/opencast/commit/1a7172c95af8d542a77ae5b153e4c834dd4788a6

Advisory 2

TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences