EUVD-2026-55521
GHSA-jppp-j33j-6m5q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint with no interaction needed; impact is read-only confidentiality with no integrity or availability effect.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.
AnalysisAI
Unauthenticated remote access to all stored contract documents is possible in OpenSignLabs opensignserver through version 2.37.0 due to a missing authentication check in the fileupload Parse cloud function. Any unauthenticated attacker who can reach the endpoint can supply an arbitrary URL and receive a MASTER_KEY-signed file access token, completely defeating the only access control layer protecting stored documents. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack vector makes this highly accessible to unsophisticated threat actors.
Technical ContextAI
opensignserver is an open-source document signing and contract management platform developed by OpenSignLabs, built on the Parse Server framework. Parse Server uses a MASTER_KEY for administrative-level operations; cloud functions that mint tokens signed with this key bypass standard ACL-based access controls entirely. The vulnerable component, the fileupload Parse cloud function, accepts a caller-supplied URL and returns a MASTER_KEY-signed file access token without performing any session validation, identity check, or authorization verification. All versions through 2.37.0 are affected per CPE cpe:2.3:a:opensignlabs:opensignserver:*:*:*:*:*:*:*:*. The root cause is CWE-306 (Missing Authentication for Critical Function): a sensitive privileged operation - minting administrative access tokens - is exposed to unauthenticated callers as a public API endpoint.
RemediationAI
No vendor-released patched version has been identified at time of analysis. Organizations should monitor the project repository at https://github.com/OpenSignLabs/OpenSign for commits or releases addressing this issue. As an immediate compensating control, network-level access to the Parse cloud function endpoint should be restricted to authenticated internal networks or placed behind a reverse proxy that enforces session authentication before forwarding requests to the Parse API; note this may disrupt legitimate document workflows and requires testing. Additionally, deploying WAF rules that block unauthenticated requests to the /functions/fileupload endpoint can reduce exposure until a formal patch is released. If the fileupload function is not required for core operations, disabling or removing it from the server configuration is the most effective compensating control.
More in Opensignserver
View allAuthentication bypass in opensignserver through 2.37.0 exposes all stored files to unauthenticated remote attackers by a
Broken object-level authorization in OpenSignLabs OpenSignServer through 2.37.0 exposes complete contract records - incl
Missing authorization in OpenSignLabs opensignserver through 2.37.0 lets unauthenticated remote attackers irreversibly d
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today