Executive brief
OpenSign is a free, open-source alternative to DocuSign used for digital document signing and verification. A vulnerability in its Parse cloud function allows attackers to forge audit trail entries—the record of who signed a document and when—without authentication. This undermines the legal validity of signed documents by allowing attackers to fabricate false evidence of document authenticity and non-repudiation.
Technical details
The vulnerability is an authentication bypass and integrity verification flaw in the OpenSign triggerevenet Parse cloud function. The function accepts viewer identity and IP address as unauthenticated, caller-supplied parameters, failing to validate the origin or legitimacy of these inputs. An attacker can craft requests to inject arbitrary audit log entries into any signed document's trail, bypassing non-repudiation protections. The vulnerability affects OpenSign through version 2.37.0 and requires only network reachability to the Parse cloud function endpoint; no prior authentication is necessary. Remediation involves implementing proper authentication checks and validating audit trail inputs server-side before recording them.
Affected products
- OpenSignLabs OpenSign through 2.37.0
Timeline
- 2026-08-11: disclosed