High severity · published Apr 9, 2026
CVE-2026-34020
Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Apache OpenMeetings · Apache Software Foundation
3.1.3 before 9.0.0 · source: vendor
OP
Openmeetings · Apache
3.1.3 before 9.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34020
Mailing List
https://lists.apache.org/thread/2h3h9do5tp17xldr0nps1yjmkx4vs3db
Not Applicable
https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/09/12
More from Apache OpenMeetings
9.8
CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
7.5
CVE-2026-33266
Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt
6.5
CVE-2026-49488
Apache OpenMeetings: Arbitrary File Read
4.3
CVE-2026-33005
Apache OpenMeetings: Insufficient checks in FileWebService