CVE-2025-54380 Opencast still publishes global system account credentials

What is CVE-2025-54380?

CVE-2025-54380 is a medium-severity vulnerability in opencast, published on 26 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

Weakness: CWE-522, CWE-200

Which versions are affected by CVE-2025-54380?

8 open source packages ship an affected version, including org.opencastproject:opencast-common, org.opencastproject:opencast-ingest-service-impl and org.opencastproject:opencast-kernel. It affects 1 product.

Products include Apereo Opencast.

How do I fix CVE-2025-54380?

Upgrade org.opencastproject:opencast-common to 17.6 or later.

Is CVE-2025-54380 being exploited?

There is no known exploitation of CVE-2025-54380 in the wild and no public exploit code.

Other vulnerabilities in opencast

• CVE-2021-43821 Files Accessible to External Parties in Opencast Critical 9.9
• CVE-2020-5206 Authentication Bypass For Endpoints With Anonymous Access in OpenCast High 8.7
• CVE-2021-32623 Opencast vulnerable to billion laughs attack (XML bomb) High 8.1
• CVE-2020-5229 Opencast stores passwords using outdated MD5 hash algorithm High 7.7
• CVE-2020-5230 Opencast uses unsafe identifiers High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j63h-hmgw-x4j7.