EUVD-2026-81057
GHSA-x43r-25j9-cfc4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated call to getDocument with missing authorization yields high confidentiality (signer data, tokens) but no integrity or availability impact; OTP-disabled config is a precondition, not a privilege.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
AnalysisAI
Unauthenticated information disclosure in OpenSign through 2.41.3 lets anyone who holds a document identifier taken from a guest signing link retrieve complete document details from the getDocument cloud function, including every signer's information, the sender's identity, and valid download tokens. The exposure only occurs when one-time-password verification is turned off on the server, and the attacker must already possess or guess a valid guest-link document ID; no account, credentials, or user interaction are required in that configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete preconditions apply. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine but confidentiality-only exposure rather than a full-compromise emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version is identified in the available intelligence; remediation is being tracked through GitHub issue #2218 (github.com/OpenSignLabs/OpenSign/issues/2218) and the VulnCheck advisory (vulncheck.com/advisories/opensign-through-2.41.3-information-disclosure-via-getdocument), so administrators should treat this as "no vendor-released patch identified at time of analysis" and apply compensating controls until an updated release appears. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all OpenSign instances and identify any running version 2.41.3 or earlier; immediately enable one-time-password verification on every OpenSign server, especially any with guest signing enabled; if OTP cannot be enabled, disable guest signing or isolate the getDocument cloud function; revoke and rotate download tokens associated with guest-link documents; review logs for unauthorized getDocument calls and document-ID guessing attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in JavaScript
View allAuthorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one
Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions for
Remote code execution in the PraisonAI TypeScript `codeMode` tool (npm package `praisonai` <= 1.7.1) lets an attacker wh
Nodemailer versions 6.9.16 through 9.0.x mis-parse RFC 5322 comments inside recipient addresses, so a recipient written
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers ex
Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service tha
Prototype pollution in Builder.io Gen2 SDKs at versions ≤5.2.11 (React, Vue, Svelte, Solid) and ≤0.25.13 (Qwik, Angular,
Prototype pollution in the unflatten helper of Builder.io Gen2 SDKs (the @builder.io/sdk-react, sdk-vue, sdk-svelte and
Quadratic-complexity denial of service in the Svelte devalue JavaScript deserializer (all versions prior to 5.9.2) lets
Clerk helps developers build user management. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploit
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today