CyberRota Analysis
AI-GeneratedOpenSign versions up to 2.41.3 are vulnerable due to inadequate validation of caller identity in the getDocument cloud function when one-time-password verification is disabled. This flaw allows attackers to exploit guest signing links to access sensitive document details, including signer information and download tokens, without any authentication. Organizations using OpenSign should prioritize patching this vulnerability to prevent unauthorized access to confidential data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.