CVE-2026-34020
Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
- Record
CVE-2026-34020- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-598
- Updated
- 2026-11-02
EUVDEUVD-2026-20938
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
- Record
EUVD-2026-20938- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gcvm-c75m-h4p4
Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
- Record
GHSA-gcvm-c75m-h4p4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-598
- Updated
- 2026-11-02
NVD
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
- Record
CVE-2026-34020- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-598
- Updated
- 2026-11-02
OSV
Apache OpenMeetings: Login Credentials Passed via GET Query Parameters
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
- Record
CVE-2026-34020- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-598
- Updated
- 2026-11-08
OSVGHSA-gcvm-c75m-h4p4
Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
- Record
GHSA-gcvm-c75m-h4p4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-598
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.openmeetings:openmeetings-parentMaven |
3.1.3 up to 9.0.0 | 9.0.0 |
org.apache.openmeetings:openmeetings-parentMaven |
3.1.3 up to 9.0.0, plus listed versions 3.1.43.1.53.2.03.2.13.3.0 Show 24 moreShow less3.3.13.3.24.0.04.0.14.0.104.0.114.0.34.0.44.0.54.0.64.0.74.0.95.0.05.0.0-M15.0.0-M25.0.0-M35.0.0-M45.1.06.2.06.3.07.0.07.2.08.0.08.1.0 |
9.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34020 is a high vulnerability (CVSS 7.5) in Apache Openmeetings, published April 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in org.apache.openmeetings:openmeetings-parent 9.0.0.
References
owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url
lists.apache.org/thread/2h3h9do5tp17xldr0nps1yjmkx4vs3db
openwall.com/lists/oss-security/2026/04/09/12
nvd.nist.gov/vuln/detail/CVE-2026-34020
github.com/advisories/GHSA-gcvm-c75m-h4p4