CVE-2026-75106

CRITICAL 9.1

OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

CWE	CWE-340
Vendor	opnform
Product	opnform
Published	Aug 17, 2026

Stay Ahead of the Next One

Get instant alerts for opnform opnform

Be the first to know when new critical vulnerabilities affecting opnform opnform are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

OpnForm / OpnForm

0 < 2.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpnForm/OpnForm/issues/1259 github.com: https://github.com/OpnForm/OpnForm github.com: https://github.com/OpnForm/OpnForm/commit/6c67ff0a9bc0ac27ae26b32b8e108a176f8161b1 github.com: https://github.com/OpnForm/OpnForm/releases/tag/v2.0.2 vulncheck.com: https://www.vulncheck.com/advisories/opnform-editable-submission-secret-derivation-via-empty-hashids-salt

Credits

🔍 geo-chen