CVE-2026-93984: OpenPanel API Authentication Bypass via Unverified Client Secret
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs only a public client ID. They can provide an arbitrary dummy client secret because the API does not verify its cryptographic hash before authorizing affected requests.
What can an attacker do after bypassing authentication?
They can inject forged revenue metrics and bypass bot detection filters. The provided impact information indicates integrity impact, with no stated confidentiality or availability impact.
Which deployments are affected?
The issue affects the OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994. The supplied data does not identify affected release versions or configuration-specific conditions.