CVE-2026-77614: Opencast: Session fixation in login enables account takeover via crafted link
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mhdefaultorg.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opencastto a version that resolves this vulnerability.Fixed in 19.7 - Upgrade
Upgrade
opencastto a version that resolves this vulnerability.Fixed in 20.2
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Opencast deployments using the default security configuration in etc/security/mh_default_org.xml are affected before versions 19.7 and 20.2. The vulnerable behavior is acceptance of a client-selected JSESSIONID supplied through the ;jsessionid= URL path parameter.
What conditions must an attacker meet to exploit it?
The attacker does not need to authenticate, but must persuade a victim to open a crafted link. The victim's browser must not already have an active Opencast session cookie, and the victim must then log in.
What is the impact if the targeted user is an administrator?
An attacker who knows the session identifier can reuse it after the victim authenticates and act as that victim. If the victim is an administrator, this can result in full administrative account takeover.
What should be prioritized for remediation?
Upgrade Opencast to version 19.7 or 20.2, which fix the issue. The affected default configuration should no longer accept and retain a client-selected session identifier across login.