CVE-2026-72691 in OpenSignServer
Summary
by MITRE • 08/10/2026
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authentication bypass flaw in the OpenSignLabs opensignserver platform version 2.37.0 and earlier, which fundamentally undermines the system's security model. The issue resides within the getsignedurl Parse cloud function where the authentication verification mechanism fails to properly validate user credentials when processing document access requests. The vulnerability stems from a logical error in the function's authorization logic that allows any arbitrary string value for the docId parameter to bypass the isAuthenticated check entirely, effectively rendering the authentication layer ineffective.
The technical implementation of this flaw demonstrates poor input validation and authentication flow control where the system assumes that providing any docId parameter automatically grants access rights regardless of whether the user is authenticated or whether the document actually exists. This creates a scenario where an unauthenticated attacker can generate MASTER_KEY-signed file access tokens for any arbitrary stored files within the system's storage, effectively granting them access to potentially sensitive documents without proper authorization. The vulnerability operates at the application layer and exploits a weakness in the function's parameter handling logic that was designed to accommodate various document identifiers but failed to implement proper access controls.
From an operational impact perspective, this authentication bypass allows attackers to gain unauthorized access to stored documents across the entire file repository, potentially exposing confidential information including personal data, business documents, or proprietary content. The MASTER_KEY-signed tokens generated through this vulnerability can be used to access files indefinitely without additional authentication requirements, making the compromise particularly dangerous as it provides persistent access to the system's data store. Security teams must consider that this vulnerability could enable data exfiltration, intellectual property theft, or compliance violations depending on the nature of the stored documents.
The vulnerability aligns with CWE-287 which addresses improper authentication issues in software systems and demonstrates characteristics consistent with ATT&CK technique T1078 which covers valid accounts for lateral movement and privilege escalation. Organizations should implement immediate mitigations including disabling or restricting access to the vulnerable getsignedurl function, implementing proper parameter validation that requires authentication checks regardless of docId values provided, and ensuring that all file access functions properly verify user credentials before generating access tokens. Additionally, organizations should conduct comprehensive audits of their Parse cloud functions to identify similar authentication bypass patterns, enforce mandatory authentication for all file access operations, and implement robust logging mechanisms to detect unauthorized access attempts. The fix should involve modifying the function logic to always require valid authentication before processing any document access requests regardless of parameter values provided.