Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-93984— OpenPanel API Authentication Bypass via Unverified Client Secret

Quick assessment

Affected
Openpanel-dev openpanel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

通过 commit bad75bddc74d12d36cfb843f4531d3b830a8d994 引入的 OpenPanel 跟踪 API 在授权收入事件（revenue events）和机器人过滤（bot filtering）之前，未能验证客户端密钥（client secret）的密码学哈希值。攻击者仅需持有公开的客户端 ID（client ID），即可提供任意伪造的密钥，从而注入虚假的收入指标并绕过机器人检测过滤器。

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1590.009
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93984

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenPanel API Authentication Bypass via Unverified Client Secret
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Openpanel-dev openpanel 0 ~ bad75bddc74d12d36cfb843f4531d3b830a8d994 -

II. Public POCs for CVE-2026-93984

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93984

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-93984 (2)

Same Patch Batch · Openpanel-dev · 2026-09-19 · 4 CVEs total

CVE-2026-93985 9.9 CRITICAL OpenPanel js-runtime JavaScript Template Sandbox Escape RCE
CVE-2026-93983 5.0 MEDIUM OpenPanel SQL Injection via ClickHouse Property Key Filter
CVE-2026-93982 3.3 LOW OpenPanel MCP Authentication Token in Query Parameter Logged Plaintext

IV. Related Vulnerabilities

Same product: openpanel
Same vendor: Openpanel-dev
Same weakness: CWE-287

V. Comments for CVE-2026-93984

No comments yet

Leave a comment