Executive brief
OpenPanel is an analytics and event ingestion platform used to track user behavior and revenue metrics. An attacker with only a public client ID can bypass authentication by providing a dummy client secret, allowing them to inject forged revenue events, corrupt analytics data, and bypass bot detection filters without needing the actual secret.
Technical details
The POST /track endpoint treats the presence of any non-empty client secret header or body parameter as authenticated without verifying its cryptographic hash against the stored password hash. Attackers can supply an arbitrary dummy secret string to set req.clientSecretAuth=true, bypassing revenue authorization gates and bot filtering logic. The vulnerability exists because password hash verification (verifyPasswordHash) never executes when CORS origin validation passes, allowing unauthenticated callers to inject events into projects that require server-side secret authorization.
Affected products
- Openpanel-dev OpenPanel <= bad75bddc74d12d36cfb843f4531d3b830a8d994
Timeline
- 2026-09-04: disclosed
- 2026-09-19: advisory