Description (CNA)
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Openpanel-dev / openpanel | affected 0 through 2.3.0 |
CWE
CWE-287
References
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-956w-65qh-w3jh
- https://www.vulncheck.com/advisories/openpanel-api-authentication-bypass-via-unverified-client-secret
ADP enrichment
No English description supplied.
No references supplied.