CVE-2026-33266 Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt

High 7.5 Published 9 Apr 2026 Updated 10 Apr 2026

Attackers can steal user credentials if the default remember-me encryption key is not changed, allowing account takeover in Apache OpenMeetings.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-33266?

CVE-2026-33266 is a high-severity vulnerability in Apache OpenMeetings, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.

The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials.

This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Weakness: CWE-321

Which versions are affected by CVE-2026-33266?

2 open source packages ship an affected version, including org.apache.openmeetings:openmeetings-parent. It affects 1 product.

Package	Affected	Fixed in
`org.apache.openmeetings:openmeetings-parent` Maven	From `6.1.0`	`9.0.0`
`org.apache.openmeetings:openmeetings-parent` Maven	From `6.1.0`	`9.0.0`

Products include Apache Openmeetings.

How do I fix CVE-2026-33266?

Upgrade org.apache.openmeetings:openmeetings-parent to 9.0.0 or later.

Is CVE-2026-33266 being exploited?

There is no known exploitation of CVE-2026-33266 in the wild and no public exploit code.

Sources

Also known as GHSA-wqxq-w68r-wg85.