CVE-2026-75106CWE-340

CVE-2026-75106

Critical · published August 18, 2026

CVSS v3.1

9.1

EPSS

Percentile

22.9

In the wild

Unconfirmed

What it is

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

The record

Technical detail

CVSS v3.1: 9.1 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00305 · 22.9th percentile
Weakness: CWE-340 · Generation of Predictable Numbers or Identifiers
Published: 2026-08-18T01:16Z

References (6)

https://github.com/OpnForm/OpnForm · [email protected]https://github.com/OpnForm/OpnForm/commit/6c67ff0a9bc0ac27ae26b32b8e108a176f8161b1 · [email protected]https://github.com/OpnForm/OpnForm/issues/1259 · [email protected]https://github.com/OpnForm/OpnForm/releases/tag/v2.0.2 · [email protected]https://www.vulncheck.com/advisories/opnform-editable-submission-secret-derivation-via-empty-hashids-salt · [email protected]https://github.com/OpnForm/OpnForm/issues/1259 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 AUG 20:36Z
OpnForm Editable Submission Secret Derivation via Empty Hashids Salt
cvelistv5