CVE-2026-77614
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.
Risk Assessment
Possible hijacking of a user session, including an administrator account, leading to unauthorized data access and full control over the platform.
Recommendation
Update Opencast to version 19.7 or 20.2 and disable accepting session identifiers from URL parameters.
Other vulnerabilities in Opencast
See all- CVE-2025-61906Medium
Prior to Opencast 17.8 and 18.2, in some situations Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, possibly exposing internal media. The risk of actual impact is very low and requires a user with write access to an event using the editor and first clicking 'Save & Publish' before selecting 'Save'.
- CVE-2025-61788Medium
In Opencast prior to versions 17.8 and 18.2, the paella player renders user-supplied metadata (title, description, etc.) without filtering. This allows an attacker to inject malicious HTML and JavaScript that executes in the browsers of users viewing the media.
- CVE-2025-55202Medium
Opencast version 18.0 and versions before 17.7 have insufficient protections against path traversal attacks in the UI config module. The path is checked without checking for the file separator, potentially allowing access to files in another folder starting with the same path. This is fixed in versions 17.7 and 18.1.
Original NVD description (English source)
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS