What is GHSA-gcvm-c75m-h4p4?

GHSA-gcvm-c75m-h4p4 is a security advisory published by GitHub Security Advisories with High severity. Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings

Which CVE IDs does GHSA-gcvm-c75m-h4p4 cover?

GHSA-gcvm-c75m-h4p4 covers the following CVE IDs: CVE-2026-34020. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gcvm-c75m-h4p4?

GHSA-gcvm-c75m-h4p4 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-gcvm-c75m-h4p4?

GHSA-gcvm-c75m-h4p4 affects 1 product, including: maven/org.apache.openmeetings:openmeetings-parent:\u003e= 3.1.3, \u003c 9.0.0.

GHSA-gcvm-c75m-h4p4HighCVSS 7.5

Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings

Vendor

GitHub Security Advisories

Published

April 9, 2026

Last Modified

April 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-34020 →

📋 Description

Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.

The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact

This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.

Users are recommended to upgrade to version 9.0.0, which fixes the issue.

🎯 Affected products1

maven/org.apache.openmeetings:openmeetings-parent:>= 3.1.3, < 9.0.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-34020
https://lists.apache.org/thread/2h3h9do5tp17xldr0nps1yjmkx4vs3db
https://owasp.org/www-community/vulnerabilities/Information_exposure_through_query_strings_in_url
http://www.openwall.com/lists/oss-security/2026/04/09/12
https://github.com/advisories/GHSA-gcvm-c75m-h4p4