CVE-2026-92794 in OpenSign
요약
\~에 의해 MITRE • 2026. 09. 16.
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.