CVE-2026-33266 describes a hard-coded cryptographic key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to a default value in the configuration file (openmeetings.properties) and is not automatically rotated. This allows an attacker who steals a valid cookie from a logged-in user to decrypt it and obtain full user credentials if the default key remains unchanged. The vulnerability affects versions from 6.1.0 before 9.0.0. The Apache Software Foundation recommends upgrading to version 9.0.0 to remediate this issue.

An attacker who steals a remember-me cookie from a logged-in user can decrypt it to obtain full user credentials if the default encryption key is still in use. This compromises user account confidentiality but does not affect integrity or availability. The vulnerability has a high severity rating (CVSS 7.5) due to the potential for credential compromise without requiring user interaction or privileges.

Users should upgrade Apache OpenMeetings to version 9.0.0, which fixes this vulnerability by removing the hard-coded default encryption key and implementing proper key management. Until upgraded, administrators should ensure the default remember-me cookie encryption key in openmeetings.properties is changed to a unique, strong value. Patch status is not explicitly confirmed in the advisory, but upgrading to version 9.0.0 is the recommended remediation.