Read the docs
TI-2026-54098 Aliases CVE-2026-77614

Opencast: Session fixation in login enables account takeover via crafted link

Priority HIGH 73CWE-384Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-384.

Summary

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Fixed opencast (opencast): 19.7, 20.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opencastopencastbefore 19.7; 20.0 to before 20.219.7, 20.2Patch availableCNA
  • opencast Vendoropencast Affected before 19.7; 20.0 to before 20.2 Fixed in 19.7, 20.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*——Apereo
  • cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions — — ·Apereo

Remediation

  • Fix · CNA opencast (opencast) Fixed in 19.7, 20.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77614

References

Other 5

  • TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
  • TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
  • TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
  • TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
  • TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8
  • TI-2020-04278 Hard-Coded Key Used For Remember-me Token in OpenCast CVSS 3.1HIGH 8.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences