CVE-2026-93984 | BDVDB-2026-377154 Detail

Description#

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-19Record published in the CVE List.
2. Version 22026-10-02Most recent update recorded in the CVE List.