Skip to main content

OpnForm EUVDEUVD-2026-60386

| CVE-2026-75106 CRITICAL
Generation of Predictable Numbers or Identifiers (CWE-340)
2026-08-17 VulnCheck GHSA-3j74-gjwg-45jm
Information Disclosure Opnform
9.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Remote, unauthenticated, no interaction, low complexity against default config; predictable IDs allow reading (C:H) and overwriting (I:H) submissions with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 17, 2026 - 21:10 vuln.today
Analysis Generated
Aug 17, 2026 - 21:10 vuln.today
CVE Published
Aug 17, 2026 - 20:36 cve.org
CRITICAL 9.3

DescriptionCVE.org

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

AnalysisAI

Broken access control in OpnForm's editable-submission feature lets unauthenticated attackers derive any submission's secret because the Hashids library is used with an empty default salt over sequential database row IDs. Since the hash of a sequential integer becomes trivially predictable, an attacker can enumerate submissions to read other respondents' full answer data via the submission-fetch endpoint or overwrite existing submissions through the answer endpoint. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify affected OpnForm endpoint
Delivery
Encode sequential IDs with default Hashids
Exploit
Query submission-fetch with predicted hash
Execution
Read respondents' submission data
Persist
POST predicted hash to answer endpoint
Impact
Overwrite victim submissions
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target OpnForm instance (pre-v2.0.2) exposes the editable-submission workflow, in which submissions are addressed by legacy Hashid identifiers derived from sequential row IDs with an empty/default Hashids salt - the default configuration for affected versions. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue, not a paper-tiger high score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who submits (or simply knows the existence of) a form on an affected OpnForm instance encodes sequential integers (1, 2, 3, …) with default Hashids settings to generate valid submission identifiers, then calls the submission-fetch endpoint to harvest other respondents' full answers, or posts to the answer endpoint with a predicted hash to silently overwrite their submissions. No authentication, credentials, or user interaction is required, and the low attack complexity makes scripted enumeration straightforward; no public POC was identified at time of analysis, but reproduction is trivial.
Remediation Vendor-released patch: upgrade to OpnForm v2.0.2 (https://github.com/OpnForm/OpnForm/releases/tag/v2.0.2), which replaces Hashids-based submission identifiers with random UUIDs (public_id) and backfills UUIDs for existing submissions via database migration, returning 404 for any legacy Hashid lookup. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all OpnForm instances running versions prior to v2.0.2 and take affected servers offline or restrict network access until patching is complete. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Opnform

View all
CVE-2025-11441 LOW POC
2.9 Oct 08

OpnForm versions up to 1.9.3 fail to properly restrict excessive authentication attempts when the X-Forwarded-For HTTP h
CVE-2025-11443 LOW POC
2.9 Oct 08

OpnForm versions up to 1.9.3 expose sensitive information through a timing-based discrepancy in the forgotten password h
CVE-2025-11442 LOW POC
2.1 Oct 08

OpnForm up to version 1.9.3 contains a cross-site request forgery vulnerability in an undisclosed API endpoint, though t
CVE-2025-11436 LOW POC
2.1 Oct 08

Unrestricted file upload in JhumanJ OpnForm through version 1.9.3 allows authenticated users to bypass upload restrictio
CVE-2025-11435 LOW POC
2.1 Oct 08

Stored cross-site scripting (XSS) in JhumanJ OpnForm up to version 1.9.3 allows remote attackers to inject malicious scr
CVE-2025-11438 LOW POC
2.1 Oct 08

Missing authorization in OpnForm up to version 1.9.3 allows authenticated remote attackers to access the /custom-domains
CVE-2025-11440 LOW POC
2.1 Oct 08

Improper access controls in OpnForm versions up to 1.9.3 allow authenticated remote attackers to manipulate the /edit fu
CVE-2025-11439 LOW POC
2.1 Oct 08

Missing authorization in OpnForm up to version 1.9.3 allows authenticated remote attackers to manipulate the /show/integ
CVE-2025-11437 LOW POC
1.9 Oct 08

Cross-site scripting vulnerability in JhumanJ OpnForm up to version 1.9.3 allows authenticated remote attackers with hig

Same weakness CWE-340 – Generation of Predictable Numbers or Identifiers

View all
CVE-2024-47945 CRITICAL POC
9.8
CVE-2025-15604 CRITICAL
9.8
CVE-2026-3256 CRITICAL
9.8
CVE-2026-11374 CRITICAL
9.0
CVE-2026-9733 CRITICAL
9.1
CVE-2026-5081 CRITICAL
9.1
CVE-2026-5085 CRITICAL
9.1
CVE-2026-42932 MEDIUM
6.9

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-60386 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy