Apache OpenMeetings stores its remember‑me cookie encryption key in openmeetings.properties with a hard‑coded default value that is never rotated unless an administrator manually changes it. Because the key remains constant, an attacker who obtains a valid cookie can decrypt it and retrieve full user credentials, thereby impersonating the logged‑in user. This threat arises from improper key management (CWE‑321) and directly enables unauthorized access.

All installations of Apache OpenMeetings from release 6.1.0 up through, but not including, version 9.0.0 are affected. Enterprises running any of these versions are vulnerable until they move to version 9.0.0 or later.

The CVSS base score of 7.5 reflects a high severity impact, while the EPSS score of less than 1% indicates a low probability of active exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker already possess a legitimate remember‑me cookie—obtained via phishing, session hijacking, or other user‑targeted methods. With the cookie, the attacker can immediately replay it to gain authenticated session access without needing additional system privileges.