Sensitive Query Strings Vulnerability in Apache OpenMeetings by Apache

CVE-2026-34020

What is CVE-2026-34020?

A security issue in Apache OpenMeetings arises from the use of the HTTP GET method for the REST login endpoint, where sensitive user credentials, such as usernames and passwords, are transmitted as query parameters. This practice exposes confidential information in URLs, making it accessible in server logs, browser history, and referrer headers. It is recommended that users upgrade to version 9.0.0 or later to mitigate this vulnerability.

References