---
id: CVE-2026-75106
title: >-
  OpnForm derives editable-submission secrets from sequential row identifiers
  using Hashids with an empty default salt, allowing unauthenticated attackers
  to compute hashes for any submission
summary: >-
  OpnForm derives editable-submission secrets from sequential row identifiers
  using Hashids with an empty default salt, allowing unauthenticated attackers
  to compute hashes for any submission. Attackers can read other respondents'
  full sub…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-340
vendor: OpnForm
product: OpnForm
affected:
  - OpnForm < 2.0.2
published: '2026-08-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75106'
references:
  - url: 'https://github.com/OpnForm/OpnForm'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/OpnForm/OpnForm/commit/6c67ff0a9bc0ac27ae26b32b8e108a176f8161b1
    label: disclosure@vulncheck.com
  - url: 'https://github.com/OpnForm/OpnForm/issues/1259'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/OpnForm/OpnForm/releases/tag/v2.0.2'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/opnform-editable-submission-secret-derivation-via-empty-hashids-salt
    label: disclosure@vulncheck.com
  - url: 'https://github.com/OpnForm/OpnForm/issues/1259'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.004
epssPercentile: 0.31465
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-18T14:14:27.447997Z'
ingestedAt: '2026-09-24T15:45:56.702Z'
---

## Overview

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.