The vulnerability arises because the REST login endpoint in Apache OpenMeetings accepts user credentials via an HTTP GET request, embedding the username and password as query string parameters. This practice exposes sensitive information in URLs that can be logged by web servers, proxies, and client browsers. Attackers who gain access to logs or observe network traffic could capture these credentials, leading to unauthorized access to the meeting platform. The issue is classified as CWE‑598, an information‑exposure weakness.

Apache OpenMeetings distributed by the Apache Software Foundation. The flaw affects all releases from 3.1.3 through the latest 8.x series, up to, but excluding, version 9.0.0. Users running any of these versions should review the application configuration and consider upgrading.

The CVSS score of 7.5 indicates a high severity level. The EPSS score is below 1 %, suggesting that this vulnerability is unlikely to be actively exploited in the wild, and it is not listed in the CISA KEV catalog. However, because credentials are transmitted in cleartext URLs, a remote attacker who can intercept or read server or proxy logs can obtain the login details. The likely attack vector is a remote, unauthenticated user accessing logs or tampering with network traffic.