GHSA-gcvm-c75m-h4p4: Apache OpenMeetings: Login Credentials Passed via GET Query Parameters

Q: Which Apache OpenMeetings deployments are affected?

Apache OpenMeetings versions from 3.1.3 up to, but not including, 9.0.0 are affected.

Q: Does an attacker need an account or user interaction to exploit this issue?

The supplied CVSS vector indicates network-based exploitation with no required privileges and no user interaction. The impact is confidentiality exposure; integrity and availability impacts are not indicated.

Q: What should teams do to remediate the issue?

Upgrade Apache OpenMeetings to version 9.0.0, which fixes the issue.

Q: How can I determine whether an installation is exposed?

Confirm the deployed Apache OpenMeetings version. Installations in the affected version range should also be reviewed for REST login requests that use GET and place usernames and passwords in query parameters.

Published Apr 9, 2026

Updated

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.

The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact

This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Affected Software

1 affected component

Apache OpenMeetings>=3.1.3<9.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OpenMeetings to a version that resolves this vulnerability.
Fixed in 9.0.0

Event History

Apr 9, 2026

CVE Published

via OSV·03:52 PM

Data Sourced

via OSV·03:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Apache OpenMeetings deployments are affected?

Apache OpenMeetings versions from 3.1.3 up to, but not including, 9.0.0 are affected.

Does an attacker need an account or user interaction to exploit this issue?

The supplied CVSS vector indicates network-based exploitation with no required privileges and no user interaction. The impact is confidentiality exposure; integrity and availability impacts are not indicated.

What should teams do to remediate the issue?

Upgrade Apache OpenMeetings to version 9.0.0, which fixes the issue.

How can I determine whether an installation is exposed?

Confirm the deployed Apache OpenMeetings version. Installations in the affected version range should also be reviewed for REST login requests that use GET and place usernames and passwords in query parameters.

GHSA-gcvm-c75m-h4p4: Apache OpenMeetings: Login Credentials Passed via GET Query Parameters

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Apache OpenMeetings deployments are affected?

Does an attacker need an account or user interaction to exploit this issue?

What should teams do to remediate the issue?

How can I determine whether an installation is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which Apache OpenMeetings deployments are affected?

Does an attacker need an account or user interaction to exploit this issue?

What should teams do to remediate the issue?

How can I determine whether an installation is exposed?