PT-2026-31641 · Apache · Apache Openmeetings

4Ra2N · Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-34020

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 3.1.3 through 8.9.99

Description The REST login endpoint uses the HTTP GET method, transmitting the username and password as query parameters. This practice exposes sensitive credentials in server logs, browser history, and potentially through network monitoring.

Recommendations Upgrade to version 9.0.0.

Fix

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2026-34020

GHSA-GCVM-C75M-H4P4

Affected Products

Apache Openmeetings

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-34020 · Security Note
• https://lists.apache.org/thread/2h3h9do5tp17xldr0nps1yjmkx4vs3db · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gcvm-c75m-h4p4 · Vendor Advisory
• https://github.com/apache/openmeetings · Note
• https://twitter.com/CVEnew/status/2042302806393307404 · Twitter Post
• https://twitter.com/oss_security/status/2042429050954666419 · Twitter Post
• https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url · Note
• http://openwall.com/lists/oss-security/2026/04/09/12 · Note
• https://twitter.com/VulmonFeeds/status/2042308338210267562 · Twitter Post