CVE-2026-93984 PUBLISHED

OpenPanel API Authentication Bypass via Unverified Client Secret

Assigner: VulnCheck
Reserved: 19.09.2026 Published: 19.09.2026 Updated: 19.09.2026

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Openpanel-dev
Product	openpanel
Versions	Default: unaffected affected from 0 to bad75bddc74d12d36cfb843f4531d3b830a8d994 (incl.)

CVE-2026-93984 PUBLISHED

OpenPanel API Authentication Bypass via Unverified Client Secret

Metrics

Product Status

Credits

References

Problem Types