Every CVE Search/ Get API key

CVE-2025-54380

Opencast still publishes global system account credentials

6.5 MediumFix available

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.43%Up 0.4 points since Jul 26, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

Opencast still publishes global system account credentials

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

Record
CVE-2025-54380
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-522
Updated
2026-11-02
EUVDEUVD-2025-22765 6.5

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

Record
EUVD-2025-22765
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-j63h-hmgw-x4j7 6.5

Opencast still publishes global system account credentials

Description

Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. The remainder are addressed with this patch.

Impact

Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.

Patches

This issue is fixed in Opencast 17.6

If you have any questions or comments about this advisory:

Record
GHSA-j63h-hmgw-x4j7
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-522
Updated
2026-11-02
NVD 6.5

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

Record
CVE-2025-54380
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-522
Updated
2026-11-02
OSV 6.5

Opencast still publishes global system account credentials

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

Record
CVE-2025-54380
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-522
Updated
2026-11-02
OSVGHSA-j63h-hmgw-x4j7 6.5

Opencast still publishes global system account credentials

Description

Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. The remainder are addressed with this patch.

Impact

Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.

Patches

This issue is fixed in Opencast 17.6

If you have any questions or comments about this advisory:

Record
GHSA-j63h-hmgw-x4j7
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-522
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.opencastproject:opencast-common
Maven
 before 17.6
17.6
org.opencastproject:opencast-ingest-service-impl
Maven
 before 17.6
17.6
org.opencastproject:opencast-kernel
Maven
 before 17.6
17.6
org.opencastproject:opencast-publication-service-oaipmh-remote
Maven
 before 17.6
17.6
org.opencastproject:opencast-common
Maven
 before 17.6, plus listed versions
10.010.110.1010.1110.12
Show 45 moreShow less
10.210.310.410.510.610.710.810.911.011.111.1011.1111.211.311.411.511.611.711.811.912.012.112.1112.1212.1312.212.312.512.612.712.812.913.013.113.1013.1113.1213.213.413.613.713.814.014.114.10
17.6
org.opencastproject:opencast-ingest-service-impl
Maven
 before 17.6, plus listed versions
10.010.110.1010.1110.12
Show 45 moreShow less
10.210.310.410.510.610.710.810.911.011.111.1011.1111.211.311.411.511.611.711.811.912.012.112.1112.1212.1312.212.312.512.612.712.812.913.013.113.1013.1113.1213.213.413.613.713.814.014.114.10
17.6
org.opencastproject:opencast-kernel
Maven
 before 17.6, plus listed versions
10.010.110.1010.1110.12
Show 45 moreShow less
10.210.310.410.510.610.710.810.911.011.111.1011.1111.211.311.411.511.611.711.811.912.012.112.1112.1212.1312.212.312.512.612.712.812.913.013.113.1013.1113.1213.213.413.613.713.814.014.114.10
17.6
org.opencastproject:opencast-publication-service-oaipmh-remote
Maven
 before 17.6, plus listed versions
10.010.110.1010.1110.12
Show 45 moreShow less
10.210.310.410.510.610.710.810.911.011.111.1011.1111.211.311.411.511.611.711.811.912.012.112.1112.1212.1312.212.312.512.612.712.812.913.013.113.1013.1113.1213.213.413.613.713.814.014.114.10
17.6

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-54380 is a medium vulnerability (CVSS 6.5) in Apereo Opencast, published July 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in org.opencastproject:opencast-common 17.6.

References

This page doesn't list everything

Left out here: 267 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open