Captboykin

**Name of the Vulnerable Software and Affected Versions** OpenPanel versions prior to commit bad75bdd **Description** The software writes Model Context Protocol (MCP) authentication tokens, which are passed via URL query parameters, into plaintext application logs without redaction. This allows attackers who have access to application stdout or centralized logging systems to capture base64-encoded credentials. These captured credentials can be used to replay MCP requests and gain unauthorized access to project analytics. **Recommendations** Update OpenPanel to a version incorporating commit bad75bdd or later.

**Name of the Vulnerable Software and Affected Versions** OpenPanel versions prior to commit bad75bdd **Description** Authenticated users can inject boolean SQL terms because the software fails to escape property keys in ClickHouse SQL queries. By supplying crafted filter names, attackers can bypass project isolation and access metrics belonging to other projects. **Recommendations** Update OpenPanel to a version including commit bad75bdd or later.

**Name of the Vulnerable Software and Affected Versions** OpenPanel versions prior to commit bad75bddc74d12d36cfb843f4531d3b830a8d994 **Description** The tracking API fails to verify the cryptographic hash of the client secret before authorizing bot filtering and revenue events. An attacker possessing only a public client ID can provide arbitrary dummy secrets to bypass bot detection filters and inject forged revenue metrics. **Recommendations** Update OpenPanel to a version that includes commit bad75bddc74d12d36cfb843f4531d3b830a8d994.

**Name of the Vulnerable Software and Affected Versions** OpenPanel js-runtime versions prior to commit bad75bdd **Description** A sandbox escape exists in the JavaScript webhook template validator. The validator fails to block computed member access to constructor chains, allowing users with project write access to bypass restrictions. By using computed property notation instead of direct dot notation, an attacker can access the `Function` constructor and execute arbitrary code within the worker process. **Recommendations** Update to a version beyond commit bad75bdd. Restrict permissions for users who can create or edit webhook templates.