CVE-2026-93984CWE-287

CVE-2026-93984

Medium · published September 19, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00415 · 34.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-19T16:16Z
References (3)
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-956w-65qh-w3jh · [email protected]https://www.vulncheck.com/advisories/openpanel-api-authentication-bypass-via-unverified-client-secret · [email protected]ttps://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-956w-65qh-w3jh · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 21 SEP 03:37Z
    EPSS moved — → 0%
    epss
  • 19 SEP 11:53Z
    OpenPanel API Authentication Bypass via Unverified Client Secret
    cvelistv5