CVE-2026-34020: Apache OpenMeetings information exposure in REST login endpoint

CVE-2026-34020 · Severity: high · CVSS 7.5 · Published 2026-04-09

Apache OpenMeetings, a web-based application for video conferencing and collaboration, contains a security flaw in its login process. The application transmits user passwords in plain text within the web address (URL) when using its programming interface (REST API). This could allow unauthorized individuals to see user credentials in browser histories, server logs, or network monitoring tools, potentially leading to account takeover.

Technologies: Apache Openmeetings, Apache Software Foundation OpenMeetings, org.apache.openmeetings:openmeetings-parent (Maven). Vendors: Apache, Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-34020 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34020 being exploited in the wild.
How severe is CVE-2026-34020?
High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?
Apache Software Foundation OpenMeetings 3.1.3 to 8.x (before 9.0.0); org.apache.openmeetings:openmeetings-parent (Maven) >= 3.1.3, < 9.0.0, ECOSYSTEM:introduced=3.1.3,fixed=9.0.0.
Is there a fix for CVE-2026-34020?
Yes. org.apache.openmeetings:openmeetings-parent (Maven): upgrade to 9.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34020 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34020?
Check whether you run Apache Openmeetings, Apache Software Foundation OpenMeetings or org.apache.openmeetings:openmeetings-parent (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.openmeetings:openmeetings-parent (Maven): upgrade to 9.0.0 or later
    # set org.apache.openmeetings:openmeetings-parent to 9.0.0 in your pom.xml or build.gradle

Technical details

Apache OpenMeetings (versions 3.1.3 through 8.x) is vulnerable to CWE-598 (Information Exposure Through Query Strings in GET Request). The REST login endpoint incorrectly utilizes the HTTP GET method, requiring the username and password to be passed as query parameters. Because query strings are frequently logged by web servers, proxies, and browser histories, this design flaw exposes sensitive credentials to anyone with access to those logs or the local machine's history. Attackers can exploit this to harvest credentials without direct interaction with the user. The issue is resolved in version 9.0.0 by moving sensitive data to the request body.

Affected products

  • Apache OpenMeetings 3.1.3 to 8.x (before 9.0.0)

Identifiers

  • CVE-2026-34020
  • GHSA-gcvm-c75m-h4p4

Timeline

  • 2026-04-09: disclosed
  • 2026-04-09: advisory
  • 2026-04-09: patched: Version 9.0.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.