TI-2025-34189 Aliases CVE-2025-54380 GHSA-j63h-hmgw-x4j7

Opencast still publishes global system account credentials

LOW 29CWE-200Published 2025-07-26 · Updated 2025-07-28

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00429 37th percentileScored 2026-11-07

Fix Fixed opencast (opencast): 17.6org.opencastproject:opencast-common (Maven): 17.6+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opencast	opencast	before 17.6	17.6	Patch available	CNA
—	org.opencastproject:opencast-common (Maven)	before 17.6	17.6	Patch available	GHSA-j63h-hmgw-x4j7
—	org.opencastproject:opencast-ingest-service-impl (Maven)	before 17.6	17.6	Patch available	GHSA-j63h-hmgw-x4j7
—	org.opencastproject:opencast-kernel (Maven)	before 17.6	17.6	Patch available	GHSA-j63h-hmgw-x4j7
—	org.opencastproject:opencast-publication-service-oaipmh-remote (Maven)	before 17.6	17.6	Patch available	GHSA-j63h-hmgw-x4j7

opencast Vendoropencast Affected before 17.6 Fixed in 17.6 Patch available CNA
org.opencastproject:opencast-common (Maven) Vendor— Affected before 17.6 Fixed in 17.6 Patch available GHSA-j63h-hmgw-x4j7
org.opencastproject:opencast-ingest-service-impl (Maven) Vendor— Affected before 17.6 Fixed in 17.6 Patch available GHSA-j63h-hmgw-x4j7
org.opencastproject:opencast-kernel (Maven) Vendor— Affected before 17.6 Fixed in 17.6 Patch available GHSA-j63h-hmgw-x4j7
org.opencastproject:opencast-publication-service-oaipmh-remote (Maven) Vendor— Affected before 17.6 Fixed in 17.6 Patch available GHSA-j63h-hmgw-x4j7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apereo:opencast::::::::	before 17.6	Vulnerable	Apereo

cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 17.6 Vulnerable ·Apereo

Remediation

Fix · CNA opencast (opencast) Fixed in 17.6
Fix · GHSA-j63h-hmgw-x4j7 org.opencastproject:opencast-common (Maven) Fixed in 17.6 Advisory →
Fix · GHSA-j63h-hmgw-x4j7 org.opencastproject:opencast-ingest-service-impl (Maven) Fixed in 17.6 Advisory →
Fix · GHSA-j63h-hmgw-x4j7 org.opencastproject:opencast-kernel (Maven) Fixed in 17.6 Advisory →
Fix · GHSA-j63h-hmgw-x4j7 org.opencastproject:opencast-publication-service-oaipmh-remote (Maven) Fixed in 17.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-54380
2026-10-03 Alias added: GHSA-j63h-hmgw-x4j7

References

Patch 1

https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9a

Advisory 2

Other 3

TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences