Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-33266 is a high-severity Use of Hard-coded Cryptographic Key (CWE-321) vulnerability in Apache Openmeetings. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Private Keys (T1552.004); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33266 is a Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings, where the remember-me cookie encryption key defaults to a static value in the openmeetings.properties file without automatic rotation. If administrators have not manually changed this key, stolen cookies can be decrypted to reveal full user credentials. The issue affects Apache OpenMeetings versions from 6.1.0 up to but not including 9.0.0, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-321.
An unauthenticated attacker with network access can exploit this by stealing a remember-me cookie from a logged-in user, such as through network interception or cross-site scripting if combined with other vectors. With the default key, the attacker can decrypt the cookie to obtain the user's full credentials, enabling account takeover and potential further compromise within the OpenMeetings environment.
Apache advisories recommend upgrading to version 9.0.0, which resolves the issue by addressing the hard-coded key problem. Additional details are available in the Apache mailing list announcement at https://lists.apache.org/thread/b05jnp9563v49zq494lox9kjbhhf2w66 and the oss-security mailing list at http://www.openwall.com/lists/oss-security/2026/04/09/11.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20936
Vulnerability Data
Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen…
more
a cookie from a logged-in user can get full user credentials. This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requiring cryptographic keys to be established and managed according to defined requirements prevents developers from embedding static unchangeable keys.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-SDLC activities such as code review and secret scanning directly prevent embedding static keys.
Data-at-rest protection policies require proper key management and therefore discourage hard-coded keys.
Data-in-transit protection similarly depends on non-hard-coded keys for encryption.
Configuration baselines and reviews can prohibit hard-coded keys in deployed artifacts.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Key-management controls that govern generation, rotation and protection of keys make the use of embedded hard-coded cryptographic keys less likely and easier to detect.