CVE-2026-75106

CVSS 9.3 (critical) · published 2026-08-17

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

Weakness: CWE-340

Source: NVD CVE-2026-75106

References

• https://github.com/OpnForm/OpnForm
• https://github.com/OpnForm/OpnForm/commit/6c67ff0a9bc0ac27ae26b32b8e108a176f8161b1
• https://github.com/OpnForm/OpnForm/issues/1259
• https://github.com/OpnForm/OpnForm/releases/tag/v2.0.2
• https://www.vulncheck.com/advisories/opnform-editable-submission-secret-derivation-via-empty-hashids-salt
• https://github.com/OpnForm/OpnForm/issues/1259

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.