CVE-2026-93984: Openpanel-Dev Openpanel

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

Affected products

• Openpanel-Dev Openpanel: up to and including 2.3.0

Published 2026-09-19. Last modified 2026-10-02.