CVE-2026-33266: Apache OpenMeetings Hard-coded Cryptographic Key Vulnerability
Summary
CVE-2026-33266: Apache OpenMeetings Uses Hard-coded Cryptographic Key. Affects org.apache.openmeetings:openmeetings-parent versions >= 6.1.0, < 9.0.0. Fixed in 9.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache OpenMeetings is an open-source web conferencing solution that enables users to conduct online meetings, webinars, and collaborative sessions. It provides features such as video conferencing, screen sharing, and chat functionalities. However, a significant security vulnerability exists in versions from 6.1.0 to before 9.0.0, where the remember-me cookie encryption key is hard-coded and not auto-rotated, posing a risk to user credentials.
Vulnerability Detail
The vulnerability arises from the use of a hard-coded cryptographic key for encrypting the remember-me cookies in Apache OpenMeetings. If the OpenMeetings administrator does not change the default encryption key, an attacker who steals a cookie from a logged-in user can gain full access to that user's credentials. This issue can lead to unauthorized access and potential data breaches, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
9.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can manually change the default encryption key in the openmeetings.properties file. However, this is not a long-term solution, and upgrading to the patched version is strongly recommended.
Conclusion
The hard-coded cryptographic key vulnerability in Apache OpenMeetings poses a significant risk to user credentials. It is crucial for users to upgrade to version 9.0.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for org.apache.openmeetings:openmeetings-parent →
FAQ
If exploited, this vulnerability allows attackers to steal user credentials by accessing the remember-me cookies, leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects Apache OpenMeetings versions from 6.1.0 to before 9.0.0.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
If an immediate upgrade is not possible, consider changing the default encryption key in the configuration file as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.openmeetings:openmeetings-parent.
