CVE-2020-5206— Authentication Bypass For Endpoints With Anonymous Access in OpenCast
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-5206
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authentication Bypass For Endpoints With Anonymous Access in OpenCast
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apereo Opencast 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Opencast是Opencast组织的一款用于大规模自动视频捕获，管理和分发的直播视频支撑软件。 Apereo Opencast 7.6之前版本和8.1之前版本中存在授权问题漏洞。攻击者可利用该漏洞绕过访问限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2020-5206
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-5206
请登录查看更多情报信息。
- https://github.com/opencast/opencast/security/advisories/GHSA-vmm6-w4cf-7f3xx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2020-5206
Same Patch Batch · opencast · 2020-01-30 · 6 CVEs total
| CVE-2020-5229 | 7.7 HIGH | Opencast stores passwords using outdated MD5 hash algorithm |
| CVE-2020-5230 | 7.7 HIGH | Opencast uses unsafe identifiers |
| CVE-2020-5228 | 7.6 HIGH | Opencast allows unauthorized public access via OAI-PMH |
| CVE-2020-5222 | 6.8 MEDIUM | Hard-Coded Key Used For Remember-me Token in OpenCast |
| CVE-2020-5231 | 4.8 MEDIUM | Opencast users with ROLE_COURSE_ADMIN can create new users |
IV. Related Vulnerabilities
Same product: opencast
- CVE-2025-61906
Opencast's editor accidentally publishes videos/overwrites p - CVE-2025-61788
Opencast Paella Player 7 vulnerable to Cross-Site-Scripting - CVE-2025-55202
Opencast has a partial path traversal vulnerability in UI co - CVE-2025-54380
Opencast still publishes global system account credentials - CVE-2024-52797
Searching Opencast may cause a denial of service
Same vendor: opencast
- CVE-2025-61906
Opencast's editor accidentally publishes videos/overwrites p - CVE-2025-61788
Opencast Paella Player 7 vulnerable to Cross-Site-Scripting - CVE-2025-55202
Opencast has a partial path traversal vulnerability in UI co - CVE-2025-54380
Opencast still publishes global system account credentials - CVE-2024-52797
Searching Opencast may cause a denial of service
Same weakness: CWE-285
- CVE-2026-8241
Industrial Application Software IAS Canias ERP RMI iasGetSer - CVE-2026-42202
nova-toggle-5: Improper authorization on toggle endpoint all - CVE-2026-33823
Microsoft Team Events Portal Information Disclosure Vulnerab - CVE-2026-41572
Note Mark: Unauthenticated read of notes and assets in soft- - CVE-2026-7713
crocodilestick Calibre-Web-Automated Kobo auth-token Route k
V. Comments for CVE-2020-5206
No comments yet