PT-2026-95821 · Openpanel · Openpanel
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
OpenPanel versions prior to commit bad75bddc74d12d36cfb843f4531d3b830a8d994
Description
The tracking API fails to verify the cryptographic hash of the client secret before authorizing bot filtering and revenue events. An attacker possessing only a public client ID can provide arbitrary dummy secrets to bypass bot detection filters and inject forged revenue metrics.
Recommendations
Update OpenPanel to a version that includes commit bad75bddc74d12d36cfb843f4531d3b830a8d994.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openpanel