CVE-2020-5222: Apereo Opencast

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1

Affected products

• Apereo Opencast: before 7.6 (fixed in 7.6); version 8.0 only

Published 2020-01-30. Last modified 2026-06-17.