What is the CVSS score of CVE-2026-33266?

CVE-2026-33266 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Openmeetings are affected by CVE-2026-33266?

Apache OpenMeetings versions 6.1.0 through 9.0.0 contain a hard-coded cryptographic key that enables attackers to decrypt stolen session cookies and extract user credentials without authentication.. A patch is available.

How to fix or mitigate CVE-2026-33266?

Within 24 hours: Identify all Apache OpenMeetings instances in production and document version numbers and deployment scope. Within 7 days: Implement network segmentation to restrict access to OpenMeetings administrative interfaces and rotate all user passwords for accounts that have accessed affected instances. Within 30 days: Upgrade to Apache OpenMeetings 10.0.0 or later (first patched version), or execute compensating controls if upgrade is not immediately feasible.

Apache Openmeetings CVE-2026-33266

EUVD-2026-20936 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-09 apache

GHSA-wqxq-w68r-wg85

Apache Information Disclosure Apache Openmeetings Apache Software Foundation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 11, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 16:00 euvd

EUVD-2026-20936

Analysis Generated

Apr 09, 2026 - 16:00 vuln.today

CVE Published

Apr 09, 2026 - 15:52 nvd

HIGH 7.5

DescriptionCVE.org

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.

The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.

This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

AnalysisAI

Hard-coded cryptographic key in Apache OpenMeetings 6.1.0-9.0.0 enables cookie-based credential theft. The default remember-me cookie encryption key in openmeetings.properties is not auto-rotated, allowing attackers who steal session cookies to decrypt and extract full user credentials without authentication. This unauthenticated network-accessible vulnerability achieves high confidentiality impact through cryptographic weakness. No public exploit identified at time of analysis. EPSS indicates low observed exploitation activity.

Technical ContextAI

CWE-321 violation: static default encryption key hardcoded in configuration file (openmeetings.properties) for remember-me session cookies. Lack of automatic key rotation enables cryptanalytic attacks on stolen cookies across all default installations. CVSS vector AV:N/AC:L/PR:N indicates remotely exploitable with low complexity once cookie material is obtained through separate means (network interception, XSS, physical access).

RemediationAI

Vendor-released patch: Apache OpenMeetings 9.0.0 eliminates the hard-coded encryption key. Immediately upgrade all instances to version 9.0.0 from official Apache repositories. Before upgrading, administrators must manually regenerate the remember-me encryption key in openmeetings.properties to a cryptographically random value, then invalidate all existing remember-me cookies by forcing user re-authentication. Post-upgrade, implement key rotation procedures per security best practices. Official advisory: https://lists.apache.org/thread/b05jnp9563v49zq494lox9kjbhhf2w66 | Additional context: http://www.openwall.com/lists/oss-security/2026/04/09/11