by Kastro
Paper/Archive/CVE-2026-75106

CVE-2026-75106

OpnForm OpnForm — OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

EPSS 0.4%public exploitCVSS 9.3
critical.is priorityof 100
45
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 34.2.342 × 206.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

Affected

ProductAffectedFixed inSource
OpnForm< 2.0.22.0.2CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/OpnForm/OpnForm/issues/1259refgithub.com/OpnForm/OpnFormpatchgithub.com/OpnForm/OpnForm/commit/6c67ff0a9bc0ac27ae26b32b8e108a176f8161b1refgithub.com/OpnForm/OpnForm/releases/tag/v2.0.2writeupvulncheck.com/advisories/opnform-editable-submission-secret-derivation-via-empty-hashids-salt