What’s Vulnerable › Vulnerabilities

CVE-2026-72549: OpenSignLabs OpenSign - Information Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-200

Description

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.

Affected products

• OpenSignLabs OpenSign: through 2.37.0

References

• https://github.com/OpenSignLabs/OpenSign

Get alerted when CVE-2026-72549 or the next vulnerability affects your stack