Executive brief
Apache OpenMeetings, a web-based application for video conferencing and collaboration, contains a security flaw in its login process. The application transmits user passwords in plain text within the web address (URL) when using its programming interface (REST API). This could allow unauthorized individuals to see user credentials in browser histories, server logs, or network monitoring tools, potentially leading to account takeover.
Technical details
Apache OpenMeetings (versions 3.1.3 through 8.x) is vulnerable to CWE-598 (Information Exposure Through Query Strings in GET Request). The REST login endpoint incorrectly utilizes the HTTP GET method, requiring the username and password to be passed as query parameters. Because query strings are frequently logged by web servers, proxies, and browser histories, this design flaw exposes sensitive credentials to anyone with access to those logs or the local machine's history. Attackers can exploit this to harvest credentials without direct interaction with the user. The issue is resolved in version 9.0.0 by moving sensitive data to the request body.
Affected products
- Apache OpenMeetings 3.1.3 to 8.x (before 9.0.0)
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
- 2026-04-09: patched: Version 9.0.0 released