CVEvulnerability

CVE-2026-34020

7.5 HIGH Published 2026-04-09 Modified 2026-10-26 Official page ↗

Status: Analyzed
Published: 2026-04-09
Last modified: 2026-10-26
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-598

Description

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Affected configurations

• apache openmeetings (>= 3.1.3 < 9.0.0)

Weakness · CWE (1)

CWE-598 Use of HTTP Request With Sensitive Query String weakness

References

https://lists.apache.org/thread/2h3h9do5tp17xldr0nps1yjmkx4vs3db Mailing List, Vendor Advisory
https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url Not Applicable
http://www.openwall.com/lists/oss-security/2026/04/09/12 Mailing List, Third Party Advisory

CVE-2026-34020

Description

Affected configurations

Related

Weakness · CWE (1)

References