CVE-2026-34020

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/2h3h9do5tp17xldr0nps1yjmkx4vs3db	Mailing List Vendor Advisory
https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url	Not Applicable
http://www.openwall.com/lists/oss-security/2026/04/09/12	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Uso del método de solicitud GET con cadenas de consulta sensibles vulnerabilidad en Apache OpenMeetings. El punto final de inicio de sesión REST utiliza el método HTTP GET con el nombre de usuario y la contraseña pasados como parámetros de consulta. Por favor, consulte las referencias con respecto al posible impacto. Este problema afecta a Apache OpenMeetings: desde 3.1.3 antes de 9.0.0. Se recomienda a los usuarios actualizar a la versión 9.0.0, que corrige el problema.

Information

Published : 2026-04-09 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34020

Mitre link : CVE-2026-34020

CVE.ORG link : CVE-2026-34020

JSON object : View

Products Affected

apache

openmeetings

CWE

CWE-598

Use of HTTP Request With Sensitive Query String

{"id": "CVE-2026-34020", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34020", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T20:13:11.755154Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache OpenMeetings", "versions": [{"status": "affected", "version": "3.1.3", "lessThan": "9.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-09T16:16:27.090", "references": [{"url": "https://lists.apache.org/thread/2h3h9do5tp17xldr0nps1yjmkx4vs3db", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url", "tags": ["Not Applicable"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/09/12", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.\n\nThe REST login endpoint uses HTTP GET method with username and password passed as query parameters.\u00a0Please check references regarding possible impact\n\n\nThis issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.\n\nUsers are recommended to upgrade to version 9.0.0, which fixes the issue."}, {"lang": "es", "value": "Uso del m\u00e9todo de solicitud GET con cadenas de consulta sensibles vulnerabilidad en Apache OpenMeetings.\n\nEl punto final de inicio de sesi\u00f3n REST utiliza el m\u00e9todo HTTP GET con el nombre de usuario y la contrase\u00f1a pasados como par\u00e1metros de consulta. Por favor, consulte las referencias con respecto al posible impacto.\n\nEste problema afecta a Apache OpenMeetings: desde 3.1.3 antes de 9.0.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 9.0.0, que corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D575157B-A67F-474D-AD60-56D636F1AF5A", "versionEndExcluding": "9.0.0", "versionStartIncluding": "3.1.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}