Answer in brief
CVE-2020-5222 records a Medium severity (CVSS 6.8) vulnerability in Hard-Coded Key Used For Remember-me Token in Opencast. The current sources do not mark it as known exploited. The current feed maps org.opencastproject:opencast-kernel (maven), org.opencastproject:opencast-kernel (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps org.opencastproject:opencast-kernel (maven), org.opencastproject:opencast-kernel (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| org.opencastproject:opencast-kernelmaven | >=0 <7.6 | 7.6 |
| org.opencastproject:opencast-kernelmaven | >=8.0 <8.1 | 8.1 |
Published upstream
Jan 30, 2020
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
### Impact The security configuration in `etc/security/mh_default_org.xml` enables a remember-me cookie based on a hash created from the [username, password, and an additional system key](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html). Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring that all systems use the same key: ```xml <sec:remember-me key="opencast" user-service-ref="userDetailsService" /> ``` This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. For example, a remember-me token obtained from develop.opencast.org can be used on stable.opencast.org without actually knowing the log-in credentials. Such an attack will usually not work on different installations – assuming that safe, unique passwords are used – but it is basically guaranteed to work to get access to all machines of one cluster if a token from one machine is compromised. ### Patches This problem is fixed in Opencast 7.6 and Opencast 8.1 ### Workarounds We strongly recommend updating to the patched version. Still, as a workaround for older versions, in `etc/security/mh_default_org.xml`, set a custom key for each server: ```xml <sec:remember-me key="CUSTOM_RANDOM_KEY" user-service-ref="userDetailsService" /> ``` ### References - [Relevant lines in the security configuration](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336) - [Spring Security Remember-Me Authentication Documentation](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html#remember-me-hash-token) ### For more information If you have any questions or comments about this advisory: - Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues) - For security-relevant information, email us at [[email protected]](mailto:[email protected]) ### Thanks Thanks to @LukasKalbertodt for reporting the issue.
Quoted source text, attributed separately from HOL analysis.