What’s Vulnerable › Vulnerabilities

CVE-2026-72688: OpenSignLabs opensignserver - Missing Authentication for Critical Function

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-10 · updated 2026-10-24
• Weakness: CWE-306

Description

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.

Affected products

• OpenSignLabs opensignserver: through 2.37.0

References

• https://github.com/OpenSignLabs/OpenSign

Get alerted when CVE-2026-72688 or the next vulnerability affects your stack