Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
MEDIUM severity

GHSA-mh8g-hprg-8363 — opencast-kernel

MEDIUMFix: opencast/opencast@1a7172c

GHSA-mh8g-hprg-8363 is a medium-severity (CVSS 6.8) Hard-coded Credentials vulnerability in org.opencastproject:opencast-kernel. A fix is available for org.opencastproject:opencast-kernel — see the affected versions and patch details below.

Hard-Coded Key Used For Remember-me Token in Opencast

Also known asCVE-2020-5222
Published
Jan 30, 2020
Updated
Sep 10, 2026
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Sep 25, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.9%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs59th percentile — riskier than 59% of all scored CVEsHighest risk

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

How urgent is this, really

GHSA-mh8g-hprg-8363 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.

Where this sits among everything scored

Of 378,567 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.

Real-World Exposure

2 pkgs affected
☕org.opencastproject:opencast-kernel☕org.opencastproject:opencast-kernel

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

The security configuration in etc/security/mh_default_org.xml enables a remember-me cookie based on a hash created from the username, password, and an additional system key. Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring that all systems use the same key:

<sec:remember-me key="opencast" user-service-ref="userDetailsService" />

This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. For example, a remember-me token obtained from develop.opencast.org can be used on stable.opencast.org without actually knowing the log-in credentials.

Such an attack will usually not work on different installations – assuming that safe, unique passwords are used – but it is basically guaranteed to work to get access to all machines of one cluster if a token from one machine is compromised.

Patches

This problem is fixed in Opencast 7.6 and Opencast 8.1

Workarounds

We strongly recommend updating to the patched version. Still, as a workaround for older versions, in etc/security/mh_default_org.xml, set a custom key for each server:

<sec:remember-me key="CUSTOM_RANDOM_KEY" user-service-ref="userDetailsService" />

References

For more information

If you have any questions or comments about this advisory:

Thanks

Thanks to @LukasKalbertodt for reporting the issue.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.opencastproject:opencast-kernelall versions7.6org.opencastproject:opencast-kernel:7.6
☕Mavenorg.opencastproject:opencast-kernel≥ 8.0&&< 8.18.1org.opencastproject:opencast-kernel:8.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.opencastproject:opencast-kernel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.opencastproject:opencast-kernel to 7.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-mh8g-hprg-8363 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-mh8g-hprg-8363 can be triaged on real exposure rather than presence alone.

Tailored to GHSA-mh8g-hprg-8363. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact The security configuration in `etc/security/mh_default_org.xml` enables a remember-me cookie based on a hash created from the [username, password, and an additional system key](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html). Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring that all systems use the same key: ```xml <sec:remember-me key="opencast" user-service-ref="userDetailsService" /> ``` This means that an attacker getting access to a remember-me token for one server can get a
O3 Security · Impact-Aware SCA

Is GHSA-mh8g-hprg-8363 in your dependencies?

O3 Security finds GHSA-mh8g-hprg-8363 across Maven dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
GHSA-mh8g-hprg-8363: opencast-kernel | O3 Security