Executive brief
OpenSign is an open-source document signing platform offering an alternative to DocuSign. An unauthenticated attacker can enumerate valid user accounts by querying the getUserId function to map email addresses to internal user identifiers, enabling targeted follow-up attacks such as account takeover or credential stuffing attempts against identified users.
Technical details
The vulnerability is an information disclosure flaw in the getUserId Parse cloud function within OpenSign through version 2.37.0. The function lacks authentication checks and directly returns internal user objectIds when queried with an email address or username. An unauthenticated remote attacker can exploit this via network access to the Parse cloud function to enumerate valid user accounts. The exposed objectIds can be leveraged as identifiers for subsequent targeted attacks. A patch addressing authentication enforcement in this function is expected in a future release.
Affected products
- OpenSignLabs OpenSign through 2.37.0
Timeline
- 2026-08-11: disclosed