What is the CVSS score of EUVD-2026-55531?

EUVD-2026-55531 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of opensignserver are affected by EUVD-2026-55531?

opensignserver versions 2.37.0 and earlier contain an authentication bypass that allows unauthenticated remote attackers to access all stored files via the getsignedurl function.

How to fix or mitigate EUVD-2026-55531?

Within 24 hours: identify and inventory all opensignserver instances running version 2.37.0 or earlier with internet connectivity, assess the sensitivity and criticality of stored documents, and implement immediate network-level access controls restricting the getsignedurl endpoint to known internal IP ranges or disable it entirely if not actively required. Within 7 days: deploy Web Application Firewall rules to detect and block exploitation attempts against getsignedurl with arbitrary docId parameters, implement strict rate limiting on Parse cloud functions, conduct a forensic review of access logs for evidence of unauthorized token issuance, and determine if any prior unauthorized access has occurred. Within 30 days: monitor the opensignserver project for security updates and prepare an upgrade strategy; as soon as a patched version is released, prioritize testing and deployment; if no patch materializes, evaluate alternative document signing solutions or implement permanent network isolation for affected instances.

opensignserver EUVD-2026-55531

| CVE-2026-72691 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-10 TuranSec

GHSA-9g58-36q9-g7mq

Authentication Bypass Opensignserver Opensignlabs

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable endpoint, zero-complexity bypass via single parameter, no credentials required; only file confidentiality impacted as write and delete are not exposed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 12:51 vuln.today

CVE Published

Aug 10, 2026 - 11:59 cve.org

HIGH 7.5

DescriptionCVE.org

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.

AnalysisAI

Authentication bypass in opensignserver through 2.37.0 exposes all stored files to unauthenticated remote attackers by allowing them to mint MASTER_KEY-signed file access tokens via the getsignedurl Parse cloud function. The bypass requires no credentials and no prior knowledge of valid document records - supplying any arbitrary string as the docId parameter causes the function to skip its isAuthenticated check entirely and issue a fully trusted signed token. No public exploit code or CISA KEV listing exists at time of analysis, but the bypass condition is trivially reproducible from the CVE description alone, making this a realistic and immediate threat to any internet-exposed instance storing sensitive signed documents.

Technical ContextAI

opensignserver (CPE: cpe:2.3:a:opensignlabs:opensignserver:*:*:*:*:*:*:*:*) is an open-source self-hosted document signing server by OpenSignLabs, built on top of Parse Server - a Node.js backend framework that exposes application logic via Parse cloud functions. The getsignedurl cloud function is responsible for generating pre-signed URLs that grant access to files stored in the server's backend. It is protected by an isAuthenticated guard designed to ensure only authorized users can obtain download tokens. The root cause (CWE-288: Authentication Bypass Using an Alternate Path or Channel) is a logic inversion flaw: the authentication check is only executed when no docId parameter is present. When a docId is supplied - regardless of whether it corresponds to a real document - the guard is short-circuited and the function proceeds to issue a MASTER_KEY-signed token. MASTER_KEY is Parse Server's highest-privilege credential, so the resulting signed URLs carry maximum trust authority across the file store.

RemediationAI

No vendor-released patch version has been confirmed at time of analysis; the upstream repository at https://github.com/OpenSignLabs/OpenSign should be monitored for a tagged release containing a fix to the getsignedurl cloud function's authentication logic. As an immediate compensating control, operators should block unauthenticated external access to the getsignedurl Parse cloud function endpoint at the reverse proxy or WAF layer, ensuring only authenticated sessions from trusted origins can invoke it - note this does not fix the underlying logic flaw and must be maintained if the perimeter changes. If the file access URL feature is not required by external users, disabling or removing the getsignedurl cloud function endpoint entirely eliminates the attack surface until a patch is available. Self-hosters with source access should apply a one-line code fix: move the isAuthenticated check outside the docId conditional so it executes unconditionally on every invocation of the function.