OpnForm - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/opnform/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 17 Aug 2026 22:50:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpnForm Editable Submission Secret Predictability Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-08-opnform-vulnerability/Mon, 17 Aug 2026 22:50:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-opnform-vulnerability/OpnForm versions prior to 2.0.2 allow unauthenticated attackers to predict submission secrets, leading to unauthorized access and modification of form data.OpnForm versions prior to 2.0.2 contain a critical vulnerability where submission secrets are derived from sequential row identifiers using the Hashids library with an empty default salt. This implementation makes the secrets predictable. An unauthenticated attacker can compute the hash corresponding to any arbitrary submission ID, enabling them to bypass authentication mechanisms intended to protect individual responses. This allows attackers to exfiltrate sensitive submission data via the submission-fetch endpoint or modify respondent answers by interacting with the answer endpoint. This vulnerability poses a high risk to data confidentiality and integrity for organizations relying on OpnForm to collect sensitive information. Users should upgrade to version 2.0.2 or later immediately to mitigate this risk.

Attack Chain

  1. Attacker identifies a target instance of OpnForm (v < 2.0.2).
  2. Attacker observes the predictable structure of the submission-fetch or answer endpoint URLs.
  3. Attacker identifies that submission identifiers are sequential integers.
  4. Attacker utilizes the Hashids library with an empty salt string to generate the expected secret hash for specific sequential integers.
  5. Attacker makes an unauthenticated HTTP GET request to the submission-fetch endpoint using the calculated hash to retrieve sensitive respondent data.
  6. Attacker makes an unauthenticated HTTP POST request to the answer endpoint using the calculated hash to overwrite or alter the submitted data.

Impact

The vulnerability allows for mass data exfiltration of all form submissions and the unauthorized modification of existing responses. Depending on the type of information collected via the forms, this could result in significant data breaches involving personally identifiable information (PII) or sensitive business intelligence.

Recommendation

Prioritized actions for security teams:

  • Update all OpnForm instances to version 2.0.2 or higher immediately to address the insecure hash generation logic.
  • Review web server access logs for anomalous, high-frequency requests to submission-fetch or answer endpoints originating from single source IPs.
  • Implement rate limiting on form submission and retrieval endpoints to hinder automated attempts to enumerate submission IDs.
]]>criticaladvisory