CVE-2026-33266

CVE-2026-33266: Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt

Vendor Apache Software Foundation

Product Apache OpenMeetings

Weakness CWE-321

Published April 9, 2026

Last update April 10, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials. This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.

Key dates

02Disclosure timeline

April 9, 2026 CVE published

April 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-33266 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/321.html AskarLabs — CWE-321 write-up Use of Hard-coded Cryptographic Key

Related vulnerabilities

04Related CVE

CVE-2023-3947 Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure CVE-2025-8625 Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution CVE-2024-13773 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Sensitive Information Exposure CVE-2023-3371 EmbedPress <= 3.7.3 - Sensitive Information Exposure CVE-2025-12177 Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key