CVE-2020-5206: Authentication Bypass For Endpoints With Anonymous Access in Opencast
Summary
CVE-2020-5206: Authentication Bypass For Endpoints With Anonymous Access in Opencast. Affects org.opencastproject:opencast-kernel across 2 version ranges.
< 7.6
>= 8.0, < 8.1
Fixed in 7.6 or 8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Opencast is an open-source system for managing and distributing audiovisual content. It provides a platform for recording, processing, and publishing multimedia content. The Opencast kernel is a core component of the Opencast system, responsible for handling authentication and access control.
Vulnerability Detail
The vulnerability (CVE-2020-5206) allows an attacker to bypass authentication for endpoints that allow anonymous access. By using a remember-me cookie with an arbitrary username, the attacker can trick Opencast into assuming proper authentication for that user. This can lead to various security issues, such as assuming the identity of the global system administrator and accessing non-public content without providing proper authentication.
How To Fix
Latest published version: 18.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.67.6 -
>= 8.0, < 8.18.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround for older, unpatched versions, disabling remember-me cookies in etc/security/mh_default_org.xml will mitigate the problem but will obviously also disable this feature without obvious indication. To deactivate this, remove the following line from the security configuration:
<sec:remember-me ... />
Conclusion
The vulnerability (CVE-2020-5206) in Opencast allows for authentication bypass and potential unauthorized access to non-public content. It is crucial to upgrade to the fixed versions (7.6 and 8.1) or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.opencastproject:opencast-kernel →
FAQ
Opencast is an open-source system for managing and distributing audiovisual content. It provides a platform for recording, processing, and publishing multimedia content.
The Opencast kernel is a core component of the Opencast system, responsible for handling authentication and access control.
The vulnerability allows an attacker to bypass authentication and assume the identity of the global system administrator. This can lead to unauthorized access to non-public content and other security issues.
The vulnerability has been fixed in Opencast versions 7.6 and 8.1. It is recommended to upgrade to one of these versions. If using an older, unpatched version, a workaround is to disable remember-me cookies in the security configuration file.
Yes, a workaround for older, unpatched versions is to disable remember-me cookies in the security configuration file. This can be done by removing the corresponding line from the configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-kernel.
