CVE-2026-93984

5.3 MEDIUMpublic exploit available

Published 2026-09-19 · Updated 2026-09-19

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-287

Public exploit & PoC references

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-956w-65qh-w3jh

All references

https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-956w-65qh-w3jh
https://www.vulncheck.com/advisories/openpanel-api-authentication-bypass-via-unverified-client-secret

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2026-11366
CRITICALCVE-2026-15210
HIGHCVE-2026-15372
HIGHCVE-2026-16036
HIGHCVE-2026-16055
UNSCOREDCVE-2026-18759
HIGHCVE-2026-18810PoC
MEDIUMCVE-2026-18816PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.