CVE-2026-34020
Apache Openmeetings 3.1.3 – 9.0.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-34020 is a high-severity Use of HTTP Request With Sensitive Query String (CWE-598) vulnerability in Apache Openmeetings. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34020 is a Use of GET Request Method With Sensitive Query Strings vulnerability (CWE-598) in Apache OpenMeetings. The issue resides in the REST login endpoint, which transmits usernames and passwords as query parameters over HTTP GET requests. This affects Apache OpenMeetings versions from 3.1.3 up to but not including 9.0.0, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
An unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. By intercepting GET requests—such as through network traffic capture, proxy logs, browser history, or server access logs—the attacker can extract sensitive credentials from the exposed query strings, resulting in high confidentiality impact without affecting integrity or availability.
Apache advisories recommend upgrading to version 9.0.0, which resolves the issue by addressing the insecure transmission of credentials. Additional details on impact and references, including Apache mailing lists and OWASP guidance on query string exposures, are available at the provided URLs.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20938
Vulnerability Data
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact This issue affects Apache OpenMeetings:…
more
from 3.1.3 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.5V14.2.1
Mitigating Controls (NIST 800-53 r5) AI
Requiring confidentiality and integrity protection for transmitted data reduces exposure of sensitive query parameters even though the control does not forbid placing secrets in URLs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent embedding sensitive data in query strings as part of input-handling and data-flow design.
HTTPS encryption protects query strings in transit but does not address the root design flaw of placing sensitive data in URLs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect sensitive data leakage via query strings.
DLP solutions can detect and block sensitive data in URLs.
Network security controls can enforce HTTPS and block sensitive data in URLs.
Application security requirements should mandate avoiding sensitive data in query strings.
Secure architecture principles discourage exposing sensitive data in URLs.
Secure coding standards directly prohibit placing secrets in query parameters.