CVE-2026-93984 MEDIUM

CVE-2026-93984: OpenPanel API Authentication Bypass via Unverified Client Secret

Vendor Openpanel-Dev
Product openpanel
Weakness CWE-287 · Improper authentication
Published September 19, 2026
Last update September 19, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

Key dates

02Disclosure timeline

September 19, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-4021 Contest Gallery <= 28.1.5 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion CVE-2025-25227 [20250402] - Joomla Core - MFA Authentication Bypass CVE-2024-10097 Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider CVE-2020-36832 Indeed Membership Pro 7.3 - 8.6 - Authentication Bypass CVE-2026-5229 Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback