Status: UPDATED | Advisory ID: CVE-2026-33266
| CVE | CVE-2026-33266 |
| CVSS | CVSS 7.5 (High). |
| Affected products | Apache openmeetings |
| Classified as | CWE-321 (Use of Hard-coded Cryptographic Key) |
Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.
The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.
This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-33266 |
| Vendor advisory | https://lists.apache.org/thread/b05jnp9563v49zq494lox9kjbhhf2w66 |