OpenSign vulnerabilities

CVEs whose affected-version data names the OpenSign package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-92794High· 7.5

1w ago

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete documen…

▾ TwilightOpenSignLabs · OpenSignEPSS 0.34%via NVD