Description
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Openpanel-dev openpanel
Default version status: unaffected
0 to < 3.0.0affected3.0.0unaffected
References
- https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-78w9-wwff-vxqc ↗
- https://github.com/Openpanel-dev/openpanel/commit/e37d15cc2a2c908667593ff7a2ee40750f74ab5b ↗
- https://www.vulncheck.com/advisories/openpanel-before-3.0.0-information-disclosure-of-ingestion-secret-hashes-via-client-list ↗