MEDIUM 6.9 NVD
CVE-2026-93984
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue event
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
References
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-956w-65qh-w3jh
- https://www.vulncheck.com/advisories/openpanel-api-authentication-bypass-via-unverified-cl
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-09-19 via NVD.
vulnfeed aggregates 14147 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.