CVE-2026-93984: Improper Authentication in Openpanel-dev openpanel
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
AI Analysis
Technical Summary
The OpenPanel tracking API in openpanel (version 0) contains an authentication flaw introduced in commit bad75bddc74d12d36cfb843f4531d3b830a8d994. It does not verify the client secret cryptographic hash before authorizing revenue events and bot filtering. Consequently, attackers with only a public client ID can provide arbitrary dummy secrets to inject falsified revenue data and circumvent bot detection mechanisms.
Potential Impact
Attackers can manipulate revenue metrics by injecting forged data and bypass bot filtering controls, potentially impacting the integrity of revenue tracking and bot detection processes within openpanel. There is no indication of privilege escalation, data disclosure, or service disruption beyond these impacts.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the tracking API and monitor for anomalous revenue event submissions if possible.
CVE-2026-93984: Improper Authentication in Openpanel-dev openpanel
Description
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
CVSS v4.0
Score 6.9medium
Affected software
Openpanel-dev
openpanel
pkg:github/openpanel-dev/openpanelRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenPanel tracking API in openpanel (version 0) contains an authentication flaw introduced in commit bad75bddc74d12d36cfb843f4531d3b830a8d994. It does not verify the client secret cryptographic hash before authorizing revenue events and bot filtering. Consequently, attackers with only a public client ID can provide arbitrary dummy secrets to inject falsified revenue data and circumvent bot detection mechanisms.
Potential Impact
Attackers can manipulate revenue metrics by injecting forged data and bypass bot filtering controls, potentially impacting the integrity of revenue tracking and bot detection processes within openpanel. There is no indication of privilege escalation, data disclosure, or service disruption beyond these impacts.
Mitigation Recommendations
No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the tracking API and monitor for anomalous revenue event submissions if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-19T10:55:49.093Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aae79c155bf5e2cf58252c0
Added to database: 09/19/2026, 12:02:09 UTC
Last enriched: 09/19/2026, 12:16:35 UTC
Last updated: 09/19/2026, 22:12:52 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.