Apache OpenMeetings vulnerabilities

6 known vulnerabilities in Apache OpenMeetings from Apache. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache OpenMeetings: Use of HTTP Request With Sensitive Query String

  CVE-2026-34020Apr 9, 2026Apache

  Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affect

• 7.5 High severity

  Apache OpenMeetings: Use of Hard-coded Cryptographic Key

  CVE-2026-33266Apr 9, 2026Apache

  Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attack

• 9.8 Critical severity

  Apache OpenMeetings: Deserialization of Untrusted Data

  CVE-2024-54676Jan 8, 2025ApacheEPSS 68.8%

  Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to po

• 7.2 High severity

  An attacker who has gained access to an admin account can perform RCE via null-byte injection…

  CVE-2023-29246May 12, 2023ApacheEPSS 1.46%

  An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

• 8.1 High severity

  Apache OpenMeetings: Improper Authentication

  CVE-2023-29032May 12, 2023ApacheEPSS 1.09%

  An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0

• 9.8 Critical severity

  Apache OpenMeetings: Missing Authentication for Critical Functionality

  CVE-2023-28326Mar 28, 2023ApacheEPSS 1.26%

  Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room