Apache OpenMeetings Hardcoded Remember-Me Cookie Encryption Key Vulnerability

A vulnerability exists in Apache OpenMeetings versions 6.1.0 prior to 9.0.0, due to the remember-me cookie encryption key being hardcoded and set to a default value in the openmeetings.properties file. This key is not automatically rotated. If the OpenMeetings administrator has not changed the default key, an attacker who steals a cookie from a logged-in user can gain access to the user's full credentials.

Impact

Exploitation of this vulnerability allows an attacker to steal user credentials from a logged-in session by intercepting the remember-me cookie, provided the default encryption key has not been changed.

Remediation

Users are advised to upgrade to Apache OpenMeetings version 9.0.0 or later, which addresses this vulnerability.