{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/opnform/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-75106"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpnForm (\u003c 2.0.2)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpnForm"],"content_html":"\u003cp\u003eOpnForm versions prior to 2.0.2 contain a critical vulnerability where submission secrets are derived from sequential row identifiers using the Hashids library with an empty default salt. This implementation makes the secrets predictable. An unauthenticated attacker can compute the hash corresponding to any arbitrary submission ID, enabling them to bypass authentication mechanisms intended to protect individual responses. This allows attackers to exfiltrate sensitive submission data via the submission-fetch endpoint or modify respondent answers by interacting with the answer endpoint. This vulnerability poses a high risk to data confidentiality and integrity for organizations relying on OpnForm to collect sensitive information. Users should upgrade to version 2.0.2 or later immediately to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target instance of OpnForm (v \u0026lt; 2.0.2).\u003c/li\u003e\n\u003cli\u003eAttacker observes the predictable structure of the submission-fetch or answer endpoint URLs.\u003c/li\u003e\n\u003cli\u003eAttacker identifies that submission identifiers are sequential integers.\u003c/li\u003e\n\u003cli\u003eAttacker utilizes the Hashids library with an empty salt string to generate the expected secret hash for specific sequential integers.\u003c/li\u003e\n\u003cli\u003eAttacker makes an unauthenticated HTTP GET request to the submission-fetch endpoint using the calculated hash to retrieve sensitive respondent data.\u003c/li\u003e\n\u003cli\u003eAttacker makes an unauthenticated HTTP POST request to the answer endpoint using the calculated hash to overwrite or alter the submitted data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for mass data exfiltration of all form submissions and the unauthorized modification of existing responses. Depending on the type of information collected via the forms, this could result in significant data breaches involving personally identifiable information (PII) or sensitive business intelligence.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all OpnForm instances to version 2.0.2 or higher immediately to address the insecure hash generation logic.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous, high-frequency requests to submission-fetch or answer endpoints originating from single source IPs.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting on form submission and retrieval endpoints to hinder automated attempts to enumerate submission IDs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T22:50:53Z","date_published":"2026-08-17T22:50:53Z","id":"https://feed.craftedsignal.io/briefs/2026-08-opnform-vulnerability/","summary":"OpnForm versions prior to 2.0.2 allow unauthenticated attackers to predict submission secrets, leading to unauthorized access and modification of form data.","title":"OpnForm Editable Submission Secret Predictability Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-08-opnform-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - OpnForm","version":"https://jsonfeed.org/version/1.1"}