This vulnerability (CVE-2026-33266) in Apache OpenMeetings involves the use of a hard-coded cryptographic key for encrypting the remember-me cookie. The default encryption key is set in the openmeetings.properties file and is not auto-rotated, which means if the default key remains unchanged, an attacker with access to a stolen cookie can decrypt it to obtain user credentials. The affected versions range from 6.1.0 before 9.0.0. The vendor recommends upgrading to version 9.0.0 where this issue is fixed.

If the default hard-coded encryption key is not changed by the administrator, an attacker who steals a remember-me cookie can decrypt it to gain full user credentials, potentially leading to unauthorized access to user accounts. This compromises user authentication security in affected Apache OpenMeetings versions prior to 9.0.0.

Users should upgrade Apache OpenMeetings to version 9.0.0 or later, where the hard-coded cryptographic key issue is fixed. Until upgraded, administrators should ensure the default encryption key in openmeetings.properties is changed to a unique value to prevent exploitation. Patch status is not explicitly confirmed beyond the recommendation to upgrade; therefore, check the vendor advisory for the latest remediation guidance.