What’s Vulnerable › Vulnerabilities

CVE-2020-5206: Authentication Bypass For Endpoints With Anonymous Access in OpenCast

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-30 · updated 2026-06-17
• Weakness: CWE-285

Description

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1

Affected products

• opencast: before 7.6; 8.0 — fixed in 7.6

How to fix

Upgrade to a fixed version: opencast 7.6. Check the vendor advisory for mitigations.

References

• https://github.com/opencast/opencast/commit/b157e1fb3b35991ca7bf59f0730329fbe7ce82e8
• https://github.com/opencast/opencast/security/advisories/GHSA-vmm6-w4cf-7f3x
• https://github.com/opencast/opencast/commit/b157e1fb3b35991ca7bf59f0730329fbe7ce82e8
• https://github.com/opencast/opencast/security/advisories/GHSA-vmm6-w4cf-7f3x

Get alerted when CVE-2020-5206 or the next vulnerability affects your stack