What’s Vulnerable › Products

opencast vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your opencast version is affected

Latest opencast vulnerabilities

• CVE-2026-77615 — Paella Player: Stored XSS via caption cue text (CVSS 8.7)
• CVE-2026-77614 — Opencast: Session fixation in login enables account takeover via crafted link (CVSS 8.8)
• CVE-2025-61906 — Opencast's editor accidentally publishes videos/overwrites publications #1626 (CVSS 4.3)
• CVE-2025-61788 — Opencast Paella Player 7 vulnerable to Cross-Site-Scripting (CVSS 5.4)
• CVE-2025-55202 — Opencast has a partial path traversal vulnerability in UI config (CVSS 5.3)
• CVE-2025-54380 — Opencast still publishes global system account credentials (CVSS 6.5)
• CVE-2024-52797 — Searching Opencast may cause a denial of service (CVSS 7.5)
• CVE-2018-16153 — (CVSS 7.5)
• CVE-2022-41965 — Opencast Authenticated OpenRedirect Vulnerability (CVSS 6.1)
• CVE-2022-29237 — Limited Authentication Bypass for Media Files in Opencast (CVSS 5.4)
• CVE-2021-43821 — Files Accessible to External Parties in Opencast (CVSS 7.7)
• CVE-2021-43807 — HTTP Method Spoofing in Opencast (CVSS 6.5)
• CVE-2021-32623 — Opencast vulnerable to billion laughs attack (XML bomb) (CVSS 6.5)
• CVE-2021-21318 — Removing access may not effect published series (CVSS 5.4)
• CVE-2020-26234 — Disabled Hostname Verification in OpenCast (CVSS 4.8)
• CVE-2020-5231 — Opencast users with ROLE_COURSE_ADMIN can create new users (CVSS 6.5)
• CVE-2020-5206 — Authentication Bypass For Endpoints With Anonymous Access in OpenCast (CVSS 10.0)
• CVE-2020-5230 — Opencast uses unsafe identifiers (CVSS 7.5)
• CVE-2020-5222 — Hard-Coded Key Used For Remember-me Token in OpenCast (CVSS 8.8)
• CVE-2020-5229 — Opencast stores passwords using outdated MD5 hash algorithm (CVSS 8.1)
• CVE-2020-5228 — Opencast allows unauthorized public access via OAI-PMH (CVSS 7.5)
• CVE-2017-1000221 — (CVSS 6.5)