CVE-2026-33266

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33266", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-18T14:16:42.998Z", "datePublished": "2026-04-09T15:52:36.105Z", "dateUpdated": "2026-04-10T18:49:13.351Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache OpenMeetings", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "9.0.0", "status": "affected", "version": "6.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "4ra2n (A code security AI agent)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.</p><p>The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. <span style=\"background-color: rgb(255, 255, 255);\">In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.</span><br></p><p>This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.</p><p>Users are recommended to upgrade to version 9.0.0, which fixes the issue.</p>"}], "value": "Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.\n\nThe remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.\n\n\nThis issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-09T15:52:36.105Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/b05jnp9563v49zq494lox9kjbhhf2w66"}], "source": {"defect": ["OPENMEETINGS-2813"], "discovery": "EXTERNAL"}, "title": "Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/09/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-09T16:29:21.634Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T18:47:33.185349Z", "id": "CVE-2026-33266", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T18:49:13.351Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/09/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-09T16:29:21.634Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-33266", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:47:33.185349Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T18:48:41.302Z"}}], "cna": {"title": "Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt", "source": {"defect": ["OPENMEETINGS-2813"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "4ra2n (A code security AI agent)"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache OpenMeetings", "versions": [{"status": "affected", "version": "6.1.0", "lessThan": "9.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/b05jnp9563v49zq494lox9kjbhhf2w66", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.\n\nThe remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.\n\n\nThis issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.</p><p>The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. <span style=\"background-color: rgb(255, 255, 255);\">In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.</span><br></p><p>This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.</p><p>Users are recommended to upgrade to version 9.0.0, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321 Use of Hard-coded Cryptographic Key"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-09T15:52:36.105Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33266", "state": "PUBLISHED", "dateUpdated": "2026-04-10T18:49:13.351Z", "dateReserved": "2026-03-18T14:16:42.998Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-09T15:52:36.105Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache OpenMeetings", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "9.0.0", "status": "affected", "version": "6.1.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*", "matchCriteriaId": "236D7F83-A2F6-4F00-A800-D7E661A4B1BE", "versionEndExcluding": "9.0.0", "versionStartIncluding": "6.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.\n\nThe remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.\n\n\nThis issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue."}, {"lang": "es", "value": "Uso de vulnerabilidad de clave criptogr\u00e1fica codificada de forma r\u00edgida en Apache OpenMeetings.\n\nLa clave de cifrado de la cookie \u2019recordarme\u2019 est\u00e1 configurada con el valor predeterminado en openmeetings.properties y no se rota autom\u00e1ticamente. En caso de que el administrador de OM no haya cambiado la clave de cifrado predeterminada, un atacante que haya robado una cookie de un usuario autenticado puede obtener las credenciales completas del usuario.\n\nEste problema afecta a Apache OpenMeetings: desde 6.1.0 antes de 9.0.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 9.0.0, que corrige el problema."}], "id": "CVE-2026-33266", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33266", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T18:47:33.185349Z", "version": "2.0.3"}}]}, "published": "2026-04-09T16:16:26.960", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/b05jnp9563v49zq494lox9kjbhhf2w66"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/09/11"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.0,9.0.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache OpenMeetings", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "openmeetings", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-10T20:28:32.842689+00:00", "value": {"mitigation_remediation": ["Upgrade Apache OpenMeetings to version\u202f9.0.0 or later."], "summary": {"action": "Immediate Patch", "impact": "Credential Theft via Cookie Replay"}, "threat_synthesis": {"affected_systems": "All installations of Apache OpenMeetings from release\u202f6.1.0 up through, but not including, version\u202f9.0.0 are affected. Enterprises running any of these versions are vulnerable until they move to version\u202f9.0.0 or later.", "description_and_impact": "Apache OpenMeetings stores its remember\u2011me cookie encryption key in openmeetings.properties with a hard\u2011coded default value that is never rotated unless an administrator manually changes it. Because the key remains constant, an attacker who obtains a valid cookie can decrypt it and retrieve full user credentials, thereby impersonating the logged\u2011in user. This threat arises from improper key management (CWE\u2011321) and directly enables unauthorized access.", "risk_and_exploitability": "The CVSS base score of 7.5 reflects a high severity impact, while the EPSS score of less than\u202f1% indicates a low probability of active exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker already possess a legitimate remember\u2011me cookie\u2014obtained via phishing, session hijacking, or other user\u2011targeted methods. With the cookie, the attacker can immediately replay it to gain authenticated session access without needing additional system privileges."}}}}, "created": "2026-04-10T08:53:09.053067+00:00", "updated": "2026-04-13T13:06:52.492006+00:00", "vendors": ["apache", "apache$PRODUCT$openmeetings"]}