CVE-2026-75106

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

EUVD-2026-60386

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

CVE-2026-75106

OpnForm (open-source form builder) contains a critical vulnerability in its editable-submission secret derivation mechanism. Secrets are generated from sequential row identifiers using Hashids with an empty default salt , making them fully predictable. An unauthenticated attacker can compute vali...

CVE-2026-75106 OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or...

Denial Of Service (DoS)

hashids is vulnerable to denial of service DoS. The vulnerability exists in the decode function in Hashids class whereby a remote attacker is able to produce an infinite loop that could lead to an application crash by submitting certain string of characters...