CVE-2026-33266CWE-321

Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt

High · published April 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.

The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.

This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.8th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-04-09T15:52Z
EPSS history
Timeline
  • 09 APR 15:52Z
    Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
    cvelistv5