CVE-2025-54380: Opencast Common, Ingest Service, Kernel, and Publication Service Credentials Exposure Vulnerability
Summary
CVE-2025-54380: Opencast still publishes global system account credentials. Affects org.opencastproject:opencast-common versions < 17.6. Fixed in 17.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Opencast is an open-source software platform designed for managing and distributing video content. It provides tools for video capture, editing, and publishing, making it a popular choice for educational institutions and organizations that require video management solutions. The platform includes various components such as opencast-common, opencast-ingest-service-impl, opencast-kernel, and opencast-publication-service-oaipmh-remote, each serving specific functionalities within the ecosystem. However, prior to version 17.6, these components were susceptible to a vulnerability that could expose hashed global system account credentials.
Vulnerability Detail
The vulnerability arises from the incorrect handling of hashed global system account credentials (specifically, 'org.opencastproject.security.digest.user' and 'org.opencastproject.security.digest.pass') when fetching mediapackage elements from a mediapackage XML file. Although a previous CVE addressed many instances of this issue, some cases remained unpatched. As a result, any user with ingest permissions could potentially exploit this vulnerability to send these credentials to a URL of their choosing, leading to unauthorized access and potential compromise of the system.
How To Fix
Latest published version: 18.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
17.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the ingest permissions to prevent unauthorized users from exploiting this vulnerability until the update is applied. Ensure that only trusted users have access to the ingest functionalities.
Conclusion
In summary, CVE-2025-54380 is a vulnerability in Opencast that could lead to the exposure of hashed global system account credentials. It is crucial to update to version 17.6 or later to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for org.opencastproject:opencast-common →
FAQ
CVE-2025-54380 is a vulnerability in Opencast that allows unauthorized users to potentially expose hashed global system account credentials.
Versions prior to 17.6 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
If an immediate update is not possible, restrict access to ingest permissions as a temporary workaround until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-common.
