Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-77614Opencast: Session fixation in login enables account takeover via crafted link

High 8.8

In plain English

A high-severity session fixation in opencast from opencast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 53.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.

Affected products (as reported)

VendorProductVersions
opencast opencast < 19.7>= 20.0, < 20.2

Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References