CVE-2026-34020: Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34020?
The severity of CVE-2026-34020 is rated as high, with a CVSS score of 7.5.
How do I fix CVE-2026-34020?
To fix CVE-2026-34020, avoid using the GET request method for sensitive information and implement POST requests for logins instead.
What impact does CVE-2026-34020 have on Apache OpenMeetings?
CVE-2026-34020 may expose login credentials to interception, as user credentials are passed in the URL.
Which versions of Apache OpenMeetings are affected by CVE-2026-34020?
CVE-2026-34020 affects Apache OpenMeetings versions prior to 3.1.3.
Which systems are vulnerable to CVE-2026-34020?
Any systems running affected versions of Apache OpenMeetings are vulnerable to CVE-2026-34020.