abraxas/openmeetings-remember-me-passwordApache OpenMeetings 9.1.0 - High - Remote - ATO - remember-me cookie replay authenticates without password
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · openmeetings-remember-me-password
Class: ATO Reach: Remote
Apache OpenMeetings 9.1.0. CVE-2026-33266 closed the hardcoded remember-me key (per-instance AES-GCM). Cookie LoggedIn still holds username+password. Opt-in checkbox credentials:rememberMe, default off. A new client with only that cookie becomes the user. No password. No JSESSIONID.
| ID | no CVE yet |
| Class | ATO |
| Reach | Remote (stolen remember-me cookie) |
| CWE | CWE-522, CWE-287 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Product | Apache OpenMeetings 9.1.0 |
| Auth | opt-in remember-me cookie |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18158 only |
| Method | Sink | Privilege |
|---|---|---|
Replay Cookie: LoggedIn | remember-me decrypt + signIn | Integrity (lab-proven): authenticated main page with no password. Control without cookie stays on sign-in. |
Offline decrypt with remember.me.key | AES-GCM payload | Recon (inferred): username+password bytes. This lab hit InvalidTag on a manual decrypt; replay still worked. |
Closed: hardcoded key (CVE-2026-33266). Default checkbox off.
cd lab
./run.sh
Last line: SUCCESS OPENMEETINGS-REMEMBER-ME-WITNESS
Suggested fix: store a rotating token, not the password. Clear LoggedIn on logout. Mark the cookie Secure. Skip remember-me when OTP is enrolled.
Abraxas Labs - https://abraxaslabs.tech - https://github.com/abraxas - https://x.com/abraxas_null - [email protected]
Vendor: [email protected]