An unauthenticated session fixation vulnerability in Opencast allows attackers to hijack user sessions, potentially leading to full administrative account takeover.

This is a session fixation flaw (CWE-384) where the application accepts a client-provided JSESSIONID via the URL path parameter and fails to rotate the identifier upon successful login. An unauthenticated attacker can force a specific session ID onto a victim, wait for them to authenticate, and subsequently hijack the active session.

The exploitation of this vulnerability can result in full administrative account takeover, granting attackers complete control over the platform and the educational content managed within it. Given the high CVSS score of 8.8, this risk represents a critical threat to data confidentiality, integrity, and availability. Unauthorized access to administrative functions could lead to significant data breaches, loss of institutional trust, and potential disruption of educational services.

Immediate Action: Update Opencast instances to version 19.7 or 20.2 immediately to resolve the session fixation flaw.

Proactive Monitoring: Review web access logs for unusual patterns involving the ;jsessionid parameter in request URLs, particularly those originating from external, unauthenticated sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and strip or block requests containing suspicious session identifiers in the URL path.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the potential for administrative account takeover, necessitates an immediate patching cycle. Organizations should prioritize updating their Opencast deployments to the fixed versions to eliminate the session fixation vector. Until updates are applied, users should be warned against clicking suspicious links that may contain manipulated URL parameters.