Skip to main content

OpenPanel EUVDEUVD-2026-83589

| CVE-2026-93984 MEDIUM
Improper Authentication (CWE-287)
2026-09-19 VulnCheck GHSA-2m8f-94rg-j65x
Authentication Bypass Openpanel
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable and unauthenticated because the public client ID is the only requirement and the secret is never checked (PR:N, AV:N, AC:L); impact is limited data-integrity forgery only (I:L, C:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Sep 19, 2026 - 12:32 vuln.today

DescriptionCVE.org

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

AnalysisAI

Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue metrics and evade bot-detection filters by supplying arbitrary dummy secrets-only a public client ID, intentionally exposed in the client-side tracking snippet, is required. Affected versions extend through commit bad75bddc74d12d36cfb843f4531d3b830a8d994; the flaw is a moderate-severity integrity issue (CVSS 3.1 I:L) with no public exploit identified at time of analysis.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires only knowledge of a valid public OpenPanel client ID, which is intentionally exposed in the client-side tracking snippet on any site using the affected build (OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but moderate-severity integrity issue, not a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openpanel

View all
CVE-2025-25871 HIGH POC
8.0 Mar 14

An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated h
CVE-2025-25872 MEDIUM POC
5.5 Mar 14

An issue in Open Panel v.0.3.4 allows a remote attacker to escalate privileges via the Fix Permissions function. Rated m
CVE-2025-25873 MEDIUM POC
5.5 Mar 14

Cross Site Request Forgery vulnerability in Open Panel OpenAdmin v.0.3.4 allows a remote attacker to escalate privileges
CVE-2026-93985 CRITICAL POC
9.4 Sep 19

Code execution in OpenPanel's js-runtime component lets an authenticated user who holds project write access escape the

CVE-2026-85614 CRITICAL
9.2 Sep 04

Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into
CVE-2026-85610 HIGH
8.7 Sep 04

Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the m
CVE-2026-85612 HIGH
8.7 Sep 04

Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly
CVE-2026-88893 HIGH
8.7 Sep 10

Unauthenticated information disclosure in OpenPanel (openpanel-dev/openpanel) exposes argon2id password hashes and full

CVE-2026-88890 HIGH
8.4 Sep 10

Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped re
CVE-2026-85613 HIGH
8.4 Sep 04

Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's brow
CVE-2026-88891 HIGH
7.2 Sep 10

OpenPanel's server-side mutation resolvers fail to enforce project access levels, allowing read-only project members to

CVE-2026-85609 MEDIUM
6.9 Sep 04

Unauthenticated full-read SSRF in Openpanel before 2.3.0 enables remote attackers to issue arbitrary server-side HTTP re

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-83589 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy