Sign in
Deutsch English Español Polski
Critical

Apache OpenMeetings missing authentication and can allow user impersonation

  • Disclosed: 28.03.2023
  • Updated: 11.10.2026 11:21

The Apache Software Foundation's OpenMeetings from 2.0.0 before 7.0.0 is missing authentication on meeting invitation URLs. An invitation URL contains a hash that automatically logs in as the invited user. An unauthorized user could obtain this URL and log in to the meeting as an invited user, in effect elevating their privileges in the meeting room. OpenMeetings 7.0.0 disables this option if a contact is not selected.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.openmeetings:openmeetings-parent >= 2.0.0, < 7.0.0 7.0.0

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-306
Platform
Java / Kotlin (Maven)
Package
org.apache.openmeetings:openmeetings-parent
Disclosed
28.03.2023
Updated
11.10.2026 11:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-3r48-3m8r-4r9w - CC BY 4.0

Vulnerability history: org.apache.openmeetings:openmeetings-parent

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (25) in the archive
Total entries
25
First → latest
06.2021 04.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 14
  • Medium 6

Disclosures per year

Severity:
  1. Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings
    High · 7.5 CVE-2026-34020 >= 3.1.3, < 9.0.0 9.0.0
  2. Apache OpenMeetings Uses Hard-coded Cryptographic Key
    High · 7.5 CVE-2026-33266 >= 6.1.0, < 9.0.0 9.0.0
  3. Apache OpenMeetings vulnerable to Deserialization of Untrusted Data
    Critical CVE-2024-54676 >= 2.1.0, < 8.0.0 8.0.0
  4. Apache OpenMeetings Improper Authentication vulnerability
    High · 8.1 CVE-2023-29032 >= 3.1.3, < 7.1.0 7.1.0
  5. Apache OpenMeetings vulnerable to remote code execution via null-bye injection
    High · 7.2 CVE-2023-29246 >= 2.0.0, < 7.1.0 7.1.0
  6. Apache OpenMeetings missing authentication and can allow user impersonation this entry
    Critical · 9.8 CVE-2023-28326 >= 2.0.0, < 7.0.0 7.0.0
  7. Apache OpenMeetings displays Tomcat version and detailed error stack trace
    High · 7.5 CVE-2017-7683 >= 1.0.0, < 3.3.0 3.3.0
  8. Apache OpenMeetings vulnerable to SQL injection
    High · 8.8 CVE-2017-7681 >= 1.0.0, < 3.3.0 3.3.0
  9. Apache OpenMeetings vulnerable to Cross-Site Request Forgery
    High · 8.8 CVE-2017-7666 >= 1.0.0, < 3.3.0 3.3.0
  10. Apache OpenMeetings does not correctly validate uploaded XML documents
    Critical · 10.0 CVE-2017-7664 >= 3.1.0, < 3.3.0 3.3.0
  11. Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file
    High · 7.5 CVE-2016-2164 < 3.1.1 3.1.1
  12. Apache OpenMeetings RCE
    Critical · 9.8 CVE-2016-8736 < 3.1.2 3.1.2
  13. Apache OpenMeetings vulnerable to Uncontrolled Resource Consumption
    High · 7.5 CVE-2017-7684 >= 1.0.0, < 3.3.0 3.3.0
  14. Apache OpenMeetings updates user password in insecure manner
    High · 7.5 CVE-2017-7688 >= 1.0.0, < 3.3.0 3.3.0
  15. Apache OpenMeetings allows flash content to be loaded from untrusted domains
    High · 7.5 CVE-2017-7680 >= 1.0.0, < 3.3.0 3.3.0
  16. Apache OpenMeetings vulnerable to parameter manipulation attacks
    High · 8.2 CVE-2017-7682 >= 3.2.0, < 3.3.0 3.3.0
  17. Apache OpenMeetings has Inadequate Encryption Strength
    Critical · 9.8 CVE-2017-7673 >= 1.0.0, < 3.3.0 3.3.0
  18. Denial of service in Apache OpenMeetings
    High · 7.5 CVE-2020-13951 >= 4.0.0, < 5.1.0 5.1.0
  19. Uncontrolled Resource Consumption in Apache OpenMeetings server
    High · 7.5 CVE-2021-27576 >= 4.0.0, < 6.0.0 6.0.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.