CVE-2026-93984OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

Açıklama

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-956w-65qh-w3jh) vendor-advisory
• VulnCheck Advisory: OpenPanel API Authentication Bypass via Unverified Client Secret third-party-advisory
• ttps://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-956w-65qh-w3jh