CVE-2026-93984 Details
Description
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
A vulnerability exists in the OpenPanel tracking API in versions through commit bad75bddc74d12d36cfb843f4531d3b830a8d994. The issue arises because the API fails to properly verify the cryptographic hash of the client secret before authorizing revenue events and applying bot filtering. This flaw allows attackers with only a public client ID to send arbitrary dummy secrets, bypassing restrictions and injecting false revenue metrics.
The client secret hash should be verified before authorizing revenue events or setting authentication flags. This can be done by modifying the authentication logic to ensure that the client secret is validated before it is trusted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 19, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenPanel | <= bad75bddc74d12d36cfb843f4531d3b830a8d994 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 19, 2026 | New CVE Received | [email protected] |