Threat Intelligence Report — CVE-2026-77614

Executive Summary

CVE-2026-77614 is a session fixation vulnerability (CWE-384) in Opencast, an open-source platform for managing educational audio and video content. The default security configuration shipped in etc/security/mh_default_org.xml accepts a client-supplied JSESSIONID value transported through the ;jsessionid= URL path parameter and fails to rotate that identifier at authentication time, letting an unauthenticated attacker pre-set a known session token and later reuse it after a victim logs in. Successful exploitation yields authenticated session access with the victim's privileges — including full administrative account takeover when an administrator is targeted — and is fixed only in Opencast 19.7 and 20.2.

Technical Analysis

The flaw is a classic session fixation issue rooted in how Opencast's default Spring Security-backed configuration (etc/security/mh_default_org.xml) handles session identifiers.

Mechanism:

1. Client-controlled session identifier acceptance. The default configuration accepts a JSESSIONID that is supplied by the client via the ;jsessionid= URL path parameter. Per the NVD description, this is the behavior of the default shipped configuration file — meaning it is the out-of-the-box posture, not an optional hardening setting.

2. No session rotation on authentication. Critically, the platform "does not replace it when the victim logs in." In a secure implementation, an application must generate a brand-new session identifier upon successful authentication (session renewal/rotation). Opencast's default configuration omits this step, so the pre-set identifier survives the authentication transition and becomes the identifier bound to the victim's authenticated, authorization-bearing session.

3. Attacker-known token. Because the attacker chooses/sets the identifier before authentication, the attacker knows the exact value that will later represent the victim's authenticated session. No cryptographic break, credential theft, or network interception is required — the identifier is simply attacker-selected and then adopted by the application.

The vulnerability class is session fixation (CWE-384). The ;jsessionid= path-parameter mechanism is a servlet-container capability that, if not disabled or mitigated, allows session IDs to be carried in URLs rather than (or in addition to) cookies. Combined with the absence of session-ID rotation on privilege transition, the two weaknesses compose into a reliable account takeover primitive. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack is network-reachable, low-complexity, requires no privileges, and requires only user interaction (the victim clicking a crafted link and authenticating), with high confidentiality, integrity, and availability impact.

No further code-level specifics (function, class, or parameter names beyond JSESSIONID and ;jsessionid=) are derivable from the provided description, and none are fabricated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the documented vulnerability class and the NVD description. No hypothetical function names or endpoints are invented.

1) Reconnaissance / target identification An attacker identifies Opencast deployments (Shodan/censys searches by title or HTML fingerprint) running a version prior to 19.7 or 20.2. The attacker confirms the instance accepts the ;jsessionid= URL path parameter, e.g., by requesting a URL of the form https://target/;jsessionid=<known-value> and observing the identifier is honored.

2) Triggering the flaw class (session fixation) The attacker crafts a link that embeds an attacker-chosen session identifier via the ;jsessionid= path parameter. The victim is lured to that link. The critical precondition, as stated in the description, is that the victim's browser must have no active Opencast session cookie — otherwise the cookie takes precedence over the URL-embedded identifier.

3) Payload / delivery Delivery is a social-engineering link (email, chat, LMS announcement, forum post). When the victim clicks the link and authenticates (or is redirected to authenticate), the application adopts the attacker-supplied JSESSIONID and — because rotation does not occur at login — binds it to the now-authenticated session. The attacker already knows the value.

4) Post-exploitation impact The attacker reuses the known identifier as the victim's authenticated session. This exposes the victim's data and actions. If the victim is an administrator, the result is full administrative account takeover — enabling data exfiltration, content manipulation, creation/modification of accounts, and configuration changes consistent with an admin role. The attacker retains session access for as long as the victim's session remains valid (until logout or expiry, assuming no rotation).

The exploitation is deterministic and low-complexity; the only gating factor is user interaction (the victim must click and log in with no pre-existing session).

Impact Assessment

• Confidentiality (High): The attacker gains read access to the victim's authenticated data and actions; administrator sessions expose platform-wide data.
• Integrity (High): The attacker can act as the victim, modifying content and, for admins, system configuration.
• Availability (High): Administrative takeover can disrupt or disable the platform (content deletion, config/account manipulation).
• Scope (Unchanged): Impact is confined to the Opencast application's security authority.
• Attack Vector (Network), Complexity (Low), Privileges (None), User Interaction (Required).

Blast radius: All Opencast deployments running versions prior to 19.7/20.2 with the default mh_default_org.xml security configuration in effect. Because this is the default configuration, exposure may be widespread across unpatched instances. Administrative sessions are the highest-value target and convert the vulnerability into complete platform compromise. Multi-tenant or institution-wide deployments amplify impact, as one admin takeover can affect all managed media, users, and integrations.

Detection Guidance

Detection is challenging because the exploitation uses legitimate authentication flows; monitoring must focus on the presence of ;jsessionid= in request URIs and anomaly detection around session lifecycle.

Sigma Rule

title: Potential Opencast Session Fixation via jsessionid Path Parameter
id: 8f2c1a44-7761-4cve-9a10-77614opencast
status: experimental
description: Detects HTTP requests containing a ;jsessionid= path parameter, consistent with CVE-2026-77614 session fixation attempts against Opencast.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77614
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_jsessionid:
    cs-uri-query|contains: ';jsessionid='
  selection_opencast:
    cs-uri-stem|contains:
      - '/admin'
      - '/login'
      - '/system'
  condition: selection_jsessionid
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs(User-Agent)
falsepositives:
  - Legacy clients or misconfigured proxies that append jsessionid to URLs
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.77614

YARA Rule

rule CVE_2026_77614_Opencast_SessionFixation
{
    meta:
        author = "valtersit.com"
        description = "Detects Opencast mh_default_org.xml configurations that may permit client-supplied jsessionid (CVE-2026-77614)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77614"
        cve = "CVE-2026-77614"
        date = "2026-01-01"

    strings:
        $f1 = "mh_default_org.xml" ascii
        $s1 = "jsessionid" ascii nocase
        $s2 = "JSESSIONID" ascii
        $s3 = "sessionFixation" ascii nocase
        $s4 = "session-fixation" ascii nocase
        $s5 = "tracking-mode" ascii nocase
        $s6 = "disable-url-rewriting" ascii nocase

    condition:
        $f1 and any of ($s1, $s2, $s3, $s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77614 Opencast Session Fixation Attempt - jsessionid Path Parameter"; flow:established,to_server; http.uri; content:";jsessionid="; nocase; http.uri; content:";jsessionid="; offset:0; classtype:attempted-user; reference:cve,2026-77614; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77614; metadata:service http; sid:202677614; rev:1;)

Elastic Detection

network where event.category == "network" and
  process.name != null and
  (
    startsWith(url.path, "javax.faces.resource") == false and
    wildcard(url.full, "*;jsessionid=*")
  )

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=opencast:access
| eval uri_lower = lower(uri)
| where like(uri_lower, "%;jsessionid=%")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, uri, useragent
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,opencast,cve-2026-77614,">
  <rule id="2026776" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">\.jsessionid=</field>
    <description>CVE-2026-77614: Opencast session fixation attempt detected - jsessionid path parameter present</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (no patch verified via tracked sources):

   • Remove or disable support for the ;jsessionid= URL path parameter at the servlet-container/reverse-proxy layer so session identifiers cannot be injected via URLs.
   • Reject and strip ;jsessionid= segments at the edge (WAF/reverse proxy) before requests reach Opencast.
   • Enforce session-ID rotation on every authentication event in the security configuration, if administratively configurable.

2. Patch / upgrade steps:

   • Upgrade to Opencast 19.7 or 20.2 (the versions stated as fixed in the NVD description) as soon as they are available in your channel.
   • Validate the upgrade source, checksums, and release notes from the official project before deployment, given the absence of corroborating patch evidence in tracked sources.

3. Long-term hardening:

   • Adopt secure session-management defaults: mandatory session regeneration at login, HttpOnly/Secure/SameSite cookie attributes, and disabling URL-based session rewriting.
   • Audit the etc/security/mh_default_org.xml configuration against secure baselines and version-control it.
   • Enforce MFA for administrative accounts to reduce the value of any single hijacked session.
   • Log and alert on any URI containing ;jsessionid= and on session reuse from unexpected source addresses.

References

• NVD — CVE-2026-77614: https://nvd.nist.gov/vuln/detail/CVE-2026-77614
• MITRE CWE-384 — Session Fixation: https://cwe.mitre.org/data/definitions/384.html
• Opencast project (vendor) — release/security information: https://opencast.org/
• CISA KEV Catalog: Not listed — no confirmed exploit-in-the-wild evidence in the provided data.
• CISA "Secure by Design" / OWASP Session Management Cheat Sheet (session fixation guidance): https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

Threat actor / exploit-in-the-wild note: No public PoC, exploit code, Nuclei template, or KEV listing is associated with this CVE in the provided data. EPSS has not yet been scored by FIRST.org (value intentionally not estimated). Exploitation activity, if any, is unconfirmed.