CVE-2026-93984OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

Beschreibung

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-956w-65qh-w3jh) vendor-advisory
• VulnCheck Advisory: OpenPanel API Authentication Bypass via Unverified Client Secret third-party-advisory
• ttps://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-956w-65qh-w3jh