The vulnerability exists in the getsignedurl Parse cloud function of OpenSignLabs opensignserver up to version 2.37.0. This function is intended to require authentication before minting MASTER_KEY-signed file access tokens. However, it incorrectly bypasses the isAuthenticated check whenever a docId parameter is provided, regardless of its validity. This flaw allows an unauthenticated attacker to generate signed access tokens for arbitrary files, effectively bypassing authentication controls.

An unauthenticated remote attacker can obtain signed file access tokens that grant access to arbitrary stored files without proper authentication. This compromises confidentiality of stored files but does not affect integrity or availability. The CVSS 3.1 score is 7.5 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a fix is available, restrict access to the affected function or deploy compensating controls to prevent unauthenticated access to the getsignedurl function.