CVE-2026-93984

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

  • Published Sep 19, 2026
  • CVSS 6.9 medium
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-93984 at the National Vulnerability Database