Information Disclosure Vulnerability in OpenSign Product by OpenSignLabs

CVE-2026-92794

What is CVE-2026-92794?

The OpenSign application up to version 2.41.3 is susceptible to an information disclosure vulnerability that arises when the one-time password (OTP) verification is disabled. In this condition, the getDocument cloud function does not adequately validate the caller's identity, allowing attackers to exploit this flaw. By using guest signing links, malicious users can obtain sensitive document details—including comprehensive information about all signers, the sender’s identity, and acquire valid download tokens—without undergoing authentication checks. This significant security gap underscores the necessity for immediate validation enhancements in caller identity procedures.

References