PT-2026-31640 · Apache · Apache Openmeetings

4Ra2N · Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-33266

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 6.1.0 through 9.0.0

Description A hard-coded cryptographic key is used in Apache OpenMeetings. The remember-me cookie encryption key is set to a default value in the openmeetings.properties file and is not automatically rotated. If the OpenMeetings administrator has not changed the default encryption key, an attacker who obtains a cookie from a logged-in user can potentially gain full user credentials.

Recommendations Upgrade to version 9.0.0.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2026-33266

GHSA-WQXQ-W68R-WG85

Affected Products

Apache Openmeetings

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-33266 · Security Note
• https://osv.dev/vulnerability/GHSA-wqxq-w68r-wg85 · Vendor Advisory
• https://lists.apache.org/thread/b05jnp9563v49zq494lox9kjbhhf2w66 · Vendor Advisory
• https://github.com/apache/openmeetings · Note
• http://openwall.com/lists/oss-security/2026/04/09/11 · Note
• https://twitter.com/oss_security/status/2042429050954666419 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042310898052730946 · Twitter Post
• https://twitter.com/CVEnew/status/2042302805327954231 · Twitter Post