CVE-2026-77614 in Opencast
Summary
by MITRE • 09/17/2026
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within OpenCast, a widely used open-source platform for managing educational audio and video content, represents a critical flaw in session management logic that allows for unauthorized access to user accounts. This issue stems from the default security configuration found in the etc/security/mh_default_org.xml file prior to versions 19.7 and 20.2. The core technical deficiency lies in how the application handles the JSESSIONID parameter when it is provided via the URL path as ;jsessionid=. Instead of generating a new, secure session identifier upon authentication or ignoring client-supplied identifiers for security reasons, the system accepts the client-selected value and retains it even after the user successfully logs in. This behavior violates fundamental principles of secure session management which dictate that session identifiers must be unpredictable and regenerated during state transitions such as login events to prevent fixation attacks.
From an operational perspective, this flaw enables a straightforward account takeover attack vector known as Session Fixation. An unauthenticated attacker can craft a malicious link containing their own chosen JSESSIONID value embedded in the URL path parameter ;jsessionid=. By distributing this crafted link to a victim who does not yet have an active session with OpenCast, the attacker sets up the trap. When the victim clicks the link and proceeds to authenticate using valid credentials, the server accepts the pre-existing identifier rather than issuing a new one. Consequently, the attacker now possesses the same JSESSIONID that was assigned to the victim upon successful login. Since this identifier is known to the attacker prior to authentication, they can immediately reuse it in their own browser session to impersonate the authenticated user.
The impact of this vulnerability varies based on the privilege level of the targeted account but remains severe across all levels. For standard users, exploitation allows an attacker to view sensitive educational materials, access personal data, and perform actions as if they were the victim, thereby compromising confidentiality and integrity. In scenarios where the victim holds administrative privileges within OpenCast, the consequences are catastrophic. The attacker gains full control over the administration panel, which can lead to complete compromise of the platform's security posture. This includes the ability to modify system configurations, access all stored media content, manage user accounts, and potentially inject malicious scripts or alter playback mechanisms for other users. Such a breach undermines trust in educational platforms and exposes institutions to significant data privacy violations.
This vulnerability aligns with CWE-384, Session Fixation, which describes the attack where an attacker sets a known session ID on a victim's browser before authentication occurs. It also maps directly to MITRE ATT&CK technique T1078, specifically Valid Accounts and Default Credentials contexts within the Initial Access or Persistence tactics depending on how long the fixed session remains active. The lack of session regeneration post-authentication is a classic indicator of this flaw type. To mitigate this risk, organizations running affected versions must upgrade to OpenCast version 19.7 or later, where the issue has been resolved by ensuring that new session identifiers are generated upon login regardless of any client-supplied parameters. Until an upgrade is performed, administrators should consider implementing reverse proxy configurations or web application firewall rules that strip ;jsessionid= parameters from incoming requests to prevent the initial fixation attempt, although upgrading remains the definitive and recommended remediation strategy.