What is the CVSS score of CVE-2026-33266?

CVE-2026-33266 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache are affected by CVE-2026-33266?

Apache OpenMeetings versions 6.1.0 through 9.0.0 contain a hard-coded cryptographic key that enables attackers to decrypt stolen session cookies and extract user credentials without authentication.. A patch is available.

How to fix or mitigate CVE-2026-33266?

Within 24 hours: Identify all Apache OpenMeetings instances in production and document version numbers and deployment scope. Within 7 days: Implement network segmentation to restrict access to OpenMeetings administrative interfaces and rotate all user passwords for accounts that have accessed affected instances. Within 30 days: Upgrade to Apache OpenMeetings 10.0.0 or later (first patched version), or execute compensating controls if upgrade is not immediately feasible.

Apache CVE-2026-33266

EUVD-2026-20936 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-09 apache

GHSA-wqxq-w68r-wg85

Apache Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 11, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 16:00 euvd

EUVD-2026-20936

Analysis Generated

Apr 09, 2026 - 16:00 vuln.today

CVE Published

Apr 09, 2026 - 15:52 nvd

HIGH 7.5

DescriptionCVE.org

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.

The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.

This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

AnalysisAI

Hard-coded cryptographic key in Apache OpenMeetings 6.1.0-9.0.0 enables cookie-based credential theft. The default remember-me cookie encryption key in openmeetings.properties is not auto-rotated, allowing attackers who steal session cookies to decrypt and extract full user credentials without authentication. This unauthenticated network-accessible vulnerability achieves high confidentiality impact through cryptographic weakness. No public exploit identified at time of analysis. EPSS indicates low observed exploitation activity.

Technical ContextAI

CWE-321 violation: static default encryption key hardcoded in configuration file (openmeetings.properties) for remember-me session cookies. Lack of automatic key rotation enables cryptanalytic attacks on stolen cookies across all default installations. CVSS vector AV:N/AC:L/PR:N indicates remotely exploitable with low complexity once cookie material is obtained through separate means (network interception, XSS, physical access).

RemediationAI

Vendor-released patch: Apache OpenMeetings 9.0.0 eliminates the hard-coded encryption key. Immediately upgrade all instances to version 9.0.0 from official Apache repositories. Before upgrading, administrators must manually regenerate the remember-me encryption key in openmeetings.properties to a cryptographically random value, then invalidate all existing remember-me cookies by forcing user re-authentication. Post-upgrade, implement key rotation procedures per security best practices. Official advisory: https://lists.apache.org/thread/b05jnp9563v49zq494lox9kjbhhf2w66 | Additional context: http://www.openwall.com/lists/oss-security/2026/04/09/11