CVE-2026-72691: OpenSignLabs opensignserver - Authentication Bypass
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72691?
CVE-2026-72691 has a severity rating of 7.5, categorized as high.
How do I fix CVE-2026-72691?
To fix CVE-2026-72691, update OpenSignLabs opensignserver to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-72691?
CVE-2026-72691 is an authentication bypass vulnerability that allows unauthenticated remote access.
What systems are affected by CVE-2026-72691?
CVE-2026-72691 affects versions of OpenSignLabs opensignserver through 2.37.0.
What is the impact of CVE-2026-72691?
An attacker exploiting CVE-2026-72691 can mint MASTER_KEY-signed file access tokens for arbitrary stored files.