Read the docs
TI-2026-26346 Aliases CVE-2026-34020GHSA-gcvm-c75m-h4p4

Apache OpenMeetings: Login Credentials Passed via GET Query Parameters

Priority HIGH 72CWE-598Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00518 44th percentileScored 2026-11-07
Fix Fixed Apache OpenMeetings (Apache Software Foundation): 9.0.0org.apache.openmeetings:openmeetings-parent (Maven): 9.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache OpenMeetings3.1.3 to before 9.0.09.0.0Patch availableCNA
—org.apache.openmeetings:openmeetings-parent (Maven)3.1.3 to before 9.0.09.0.0Patch availableGHSA-gcvm-c75m-h4p4
  • Apache OpenMeetings VendorApache Affected 3.1.3 to before 9.0.0 Fixed in 9.0.0 Patch available CNA
  • org.apache.openmeetings:openmeetings-parent (Maven) Vendor— Affected 3.1.3 to before 9.0.0 Fixed in 9.0.0 Patch available GHSA-gcvm-c75m-h4p4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*3.1.3 to before 9.0.0VulnerableApache
  • cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:* Versions 3.1.3 to before 9.0.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache OpenMeetings (Apache Software Foundation) Fixed in 9.0.0
  • Fix · GHSA-gcvm-c75m-h4p4 org.apache.openmeetings:openmeetings-parent (Maven) Fixed in 9.0.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache OpenMeetings 9.0.0

    3 records Highest priority Priority HIGH 1 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-25683 Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and SaltPriority LOW 39
    • TI-2026-25453 Apache OpenMeetings: Insufficient checks in FileWebServicePriority LOW 20
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34020
  2. 2026-10-03 Alias added: GHSA-gcvm-c75m-h4p4
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 3

Other 2

  • TI-2024-36639 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode CVSS 3.1CRITICAL 9.8
  • TI-2020-10927 Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. CVSS 3.1HIGH 7.5
  • TI-2016-00702 Directory traversal vulnerability in the Import/Export System Backups functionality in… CVSS 3.0MEDIUM 6.5
  • TI-2023-12874 Apache OpenMeetings: allows user impersonation CVSS 3.1CRITICAL 9.8
  • TI-2016-07193 Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. CVSS 3.0CRITICAL 9.8
  • TI-2017-05300 Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. CVSS 3.0CRITICAL 10.0
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences