Skip to content
Fencer Vulns
high 8.7

CVE-2020-5206 json

Authentication Bypass For Endpoints With Anonymous Access in OpenCast

published 2020-01-30 6 y ago modified 2026-09-10 1 mo ago also GHSA-vmm6-w4cf-7f3x , EUVD-2020-0278

cvss
8.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1

Patch / fix

  • maven org.opencastproject:opencast-kernel 7.6, 8.1
  • apereo opencast 7.6

Exploit prediction

1.29% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
GitHub 3.1 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.opencastproject:opencast-kernel
<7.6
>=8.0, <8.1
7.6
8.1

Affected products

  • opencast opencast

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.