TI-2020-16055 Aliases CVE-2020-26234 GHSA-44cw-p2hm-gpf6

Disabled Hostname Verification in OpenCast

LOW 22CWE-346Published 2020-12-08 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate.

Why it matters now

EPSS 0.00279 20th percentileScored 2026-11-07

Fix Fixed opencast (opencast): 7.9, 8.9org.opencastproject:opencast-kernel (Maven): 7.9, 8.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opencast	opencast	before 7.9; 8.0 to before 8.9	7.9, 8.9	Patch available	CNA
—	org.opencastproject:opencast-kernel (Maven)	before 7.9	7.9	Patch available	GHSA-44cw-p2hm-gpf6
—	org.opencastproject:opencast-kernel (Maven)	8.0 to before 8.9	8.9	Patch available	GHSA-44cw-p2hm-gpf6

opencast Vendoropencast Affected before 7.9; 8.0 to before 8.9 Fixed in 7.9, 8.9 Patch available CNA
org.opencastproject:opencast-kernel (Maven) Vendor— Affected before 7.9 Fixed in 7.9 Patch available GHSA-44cw-p2hm-gpf6
org.opencastproject:opencast-kernel (Maven) Vendor— Affected 8.0 to before 8.9 Fixed in 8.9 Patch available GHSA-44cw-p2hm-gpf6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apereo:opencast::::::::	before 7.9; 8.0 to before 8.9	Vulnerable	Apereo

cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 7.9; 8.0 to before 8.9 Vulnerable ·Apereo

Remediation

Fix · CNA opencast (opencast) Fixed in 7.9, 8.9
Fix · GHSA-44cw-p2hm-gpf6 org.opencastproject:opencast-kernel (Maven) Fixed in 7.9 Advisory →
Fix · GHSA-44cw-p2hm-gpf6 org.opencastproject:opencast-kernel (Maven) Fixed in 8.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-26234
2026-10-03 Alias added: GHSA-44cw-p2hm-gpf6

References

Patch 1

https://github.com/opencast/opencast/commit/4225bf90af74557deaf8fb6b80b0705c9621acfc

Advisory 2

TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences