GitHub Advisoryadvisory · Maven

GHSA-gcvm-c75m-h4p4 Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings

HIGH Published 2026-04-09 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-34020
Ecosystem
Maven
Packages
org.apache.openmeetings:openmeetings-parent
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-598
Reviewed
2026-04-10

Affected packages

• Maven org.apache.openmeetings:openmeetings-parent: >= 3.1.3, < 9.0.0 → fixed in 9.0.0

Description

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-34020 Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. vulnerability

Weakness · CWE (1)

  • CWE-598 Use of HTTP Request With Sensitive Query String weakness

References