The vulnerability in OpenSignLabs OpenSign through version 2.37.0 is due to insufficient verification of data authenticity (CWE-345) in the triggerevent Parse cloud function. This function accepts viewer identity and IP address as parameters without authentication, enabling unauthenticated remote attackers to fabricate arbitrary audit log entries. As a result, attackers can tamper with the legal audit trail of any signed document, compromising the non-repudiation guarantees of the system. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

An attacker can remotely and without authentication forge audit-trail entries for signed documents, allowing tampering with the legal audit trail. This undermines the integrity of the audit logs and the non-repudiation property of the document signing process, potentially enabling denial or falsification of document signing events.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, restrict access to the triggerevent Parse cloud function if possible and monitor for suspicious activity related to audit log manipulation.