OpenSignLabs vulnerabilities
We track 9 vulnerabilities in OpenSignLabs products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
Latest OpenSignLabs vulnerabilities
- 7.5 High severity
OpenSign: Missing Authorization
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all
- 7.5 High severity
OpenSign: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns th
- 7.5 High severity
OpenSign: Authorization Bypass Through User-Controlled Key
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authoriz
- 7.5 High severity
OpenSign: Insufficient Verification of Data Authenticity
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as call
- 7.5 High severity
OpenSign: Authorization Bypass Through User-Controlled Key
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no au
- 7.5 High severity
opensignserver: Missing Authorization
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud f
- 7.5 High severity
opensignserver: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips
- 7.5 High severity
opensignserver: Authorization Bypass Through User-Controlled Key
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMaster
- 7.5 High severity
opensignserver: Missing Authentication for Critical Functionality
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens f