CVE-2026-93984 — OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID…
Published: 2026-09-19 · CVSS: 6.9 · CVSS 4.0
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7