medium5.3
CVE-2026-93984
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering.
Impact
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
Affected products
| Product | Affected versions |
|---|---|
| OpenPanel Tracking API | through 2.3.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.