Skip to content
Fencer Vulns
medium 4.8

CVE-2020-26234 json

Disabled Hostname Verification in OpenCast

published 2020-12-08 5 y ago modified 2026-07-08 4 mo ago also GHSA-44cw-p2hm-gpf6 , EUVD-2020-1477

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits
0
none known

Summary

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate.

Patch / fix

  • maven org.opencastproject:opencast-kernel 7.9, 8.9
  • apereo opencast 7.9, 8.9

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
NVD 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
NVD 2.0 2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N
GitHub 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.opencastproject:opencast-kernel
<7.9
>=8.0, <8.9
7.9
8.9

Affected products

  • opencast opencast

Classification

Weakness
  • CWE-346 Origin Validation Error
  • CWE-297 Improper Validation of Certificate with Host Mismatch

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.