CVE-2025-54380

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

• CWE-200
• CWE-522
• CWE-522

• https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9aPatch
• https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9Not Applicable
• https://github.com/opencast/opencast/security/advisories/GHSA-j63h-hmgw-x4j7Vendor Advisory

Published

Jul 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54374Eidos is an extensible framework for Personal Data Managemen…8.8
• CVE-2025-54376Hoverfly is an open source API simulation tool. In versions …7.5
• CVE-2025-54377Roo Code is an AI-powered autonomous coding agent that lives…7.8
• CVE-2025-54378HAX CMS allows you to manage your microsite universe with PH…8.3
• CVE-2025-54379LF Edge eKuiper is a lightweight IoT data analytics and stre…9.8
• CVE-2025-5438A vulnerability was found in Linksys RE6500, RE6250, RE6300,…8.8
• CVE-2025-54381BentoML is a Python library for building online serving syst…9.9
• CVE-2025-54382Cherry Studio is a desktop client that supports for multiple…8.8
• CVE-2025-54384CKAN is an open-source DMS (data management system) for powe…6.3
• CVE-2025-54385XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2025-54386Traefik is an HTTP reverse proxy and load balancer. In versi…9.8
• CVE-2025-54387IPX is an image optimizer powered by sharp and svgo. In vers…9.8