Threats tagged 'ghsa-5qgc-257q-crrq'

OpenPanel versions prior to 3.0.0 have an information disclosure vulnerability that allows users with read-level access to a project to retrieve argon2id hashes of ingestion credentials. This occurs via the client.list tRPC query, which returns full Client rows including the secret column. This exposure enables offline verification of leaked secrets without generating audit trails.