OpenPanel EUVD-2026-110525

Primary vector: no special conditions - remote unauthenticated exploitation against default configurations of OpenPanel before 3.0.0, because the /live/visitors/:projectId WebSocket route (live.router.ts) has no auth preHandler and wsVisitors skips the session + getProjectAccess checks that its sibling wsProjectEvents enforces; the projectId path segment is interpolated raw into the ClickHouse query with no cuid/format validation. Limiting factors: exfiltration is inferential (the sink is a uniq(profile_id) count, so data is recovered via UNION/boolean/count oracles rather than bulk dump), and the vendor's recommended read-only, single-statement-constrained ClickHouse user would confine impact to reads. Secondary vector (cohort.preview timeframe.start/end SQLi) is NOT unauthenticated - it requires a valid low-privilege project member whose own projectId is bound by enforceAccess, though the injected payload still reaches the shared ClickHouse tables for cross-tenant reads.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) scores 8.8 and is fully consistent with the source-code evidence: the /live/visitors/:projectId WebSocket handler (wsVisitors) calls guardSocket, which the advisory confirms only attaches an error listener and performs NO session or getProjectAccess check, so the projectId path segment reaches a raw ClickHouse string interpolation with no auth and no cuid/format validation. This makes remote, unauthenticated exploitation genuinely trivial, and SSVC marks it Automatable:yes with partial Technical Impact - a combination that normally argues for fast action, matching the 'this_week' decision label. The tempering signals are real too: EPSS is only 0.43% (37th percentile), there is no CISA KEV listing, and SSVC Exploitation is 'none' (no observed in-the-wild activity). The low EPSS despite an easy unauthenticated vector most plausibly reflects the product's small deployment footprint and the inferential nature of extraction (UNION/boolean/count oracle against a uniq(profile_id) count), not any difficulty of the bug itself - so this reads as a credible this-week priority for any org actually running OpenPanel rather than a mass-internet-scan emergency. Technical impact is confidentiality-focused (cross-tenant read of events/profiles); integrity is unaffected and availability impact is minor, consistent with VI:N/VA:L.

An unauthenticated attacker opens a WebSocket to /live/visitors/' OR 1=1 -- , whose projectId path segment breaks out of the quoted WHERE project_id = '...' literal in getActiveVisitorCount, so the returned uniq(profile_id) count reflects all tenants' events rather than one project. Using UNION/subquery or boolean count-oracle payloads, the attacker inferentially exfiltrates other tenants' events and profiles from the shared ClickHouse table with no credentials. A benign proof-of-concept demonstrating this count-oracle is published in the GHSA advisory (not verified as weaponized exploit code).