Excessive Credential Exposure in Opencast by Opencast Project
CVE-2025-54380

6.5MEDIUM

Key Information:

Vendor

Opencast

Status
Opencast
Vendor
CVE Published:
26 July 2025

What is CVE-2025-54380?

Opencast, an open-source platform for managing educational audio and video content, faced a significant issue where hashed global system account credentials could be exposed. This flaw allowed users with ingest permissions to force Opencast to transmit sensitive credentials to an arbitrary URL when requesting mediapackage elements from a mediapackage XML file. Previously implemented fixes did not fully mitigate the risk, leading to this vulnerability. The issue has been resolved in version 17.6 of Opencast.

Affected Version(s)

opencast < 17.6

References

https://github.com/opencast/opencast/security/advisories/...
x_refsource_CONFIRM
https://github.com/opencast/opencast/security/advisories/...
x_refsource_MISC
https://github.com/opencast/opencast/commit/e898043534214...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54380 : Excessive Credential Exposure in Opencast by Opencast Project