CVE-2026-77614

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.

• CWE-384

• https://github.com/opencast/opencast/commit/c36652250a026afb7cf78b663950c702669f1d3f
• https://github.com/opencast/opencast/commit/ff84128c9b3bcbd79c28192d25929dab8faf185f
• https://github.com/opencast/opencast/releases/tag/19.7
• https://github.com/opencast/opencast/releases/tag/20.2
• https://github.com/opencast/opencast/security/advisories/GHSA-6f53-jp7x-gg7p
• https://github.com/opencast/opencast/security/advisories/GHSA-6f53-jp7x-gg7p

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77607Semantic MediaWiki is a free, open-source extension to Media…6.1
• CVE-2026-77608Semantic MediaWiki is a free, open-source extension to Media…6.1
• CVE-2026-77609Semantic MediaWiki is a free, open-source extension to Media…6.1
• CVE-2026-7761The Ultimate Member plugin for WordPress is vulnerable to Ac…8.8
• CVE-2026-77610Semantic MediaWiki is a free, open-source extension to Media…6.1
• CVE-2026-77611SeaweedFS is a distributed storage system for files and blob…7.1
• CVE-2026-77615Paella Player is a set of libraries to create a multi stream…8.7
• CVE-2026-77616Semantic MediaWiki is a free, open-source extension to Media…6.1
• CVE-2026-77619Vector is a high-performance observability data pipeline. Fr…8.7
• CVE-2026-7762A heap-based buffer overflow vulnerability in the dot11ah.ko…9.8
• CVE-2026-77620Vector is a high-performance observability data pipeline. Fr…8.7
• CVE-2026-77621Vector is a high-performance observability data pipeline. Fr…9.3