CVE-2026-72544 — OpenSignLabs OpenSign - Insufficient Verification of Data Authenticity
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggereven…
Published: 2026-08-11 · CVSS: 7.5 · CVSS 3.1
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7