Description
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Openpanel-dev | openpanel | ≤ 2.3.0 | — |
References
- GitHub Security Advisory (GHSA-956w-65qh-w3jh) vendor-advisory
- VulnCheck Advisory: OpenPanel API Authentication Bypass via Unverified Client Secret third-party-advisory