Threats affecting pkg:github/opensignlabs/OpenSign

OpenSign versions up to 2.41.3 have a missing authorization check in the getDocument cloud function when one-time-password verification is disabled. This flaw allows attackers to retrieve full document details, including signer and sender information and valid download tokens, without authentication by using document identifiers from guest signing links.

An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.