Vulnerability · Published Aug 11, 2026 · Assigned by TuranSec

CVE-2026-72544OpenSignLabs OpenSign - Insufficient Verification of Data Authenticity

High 7.5

In plain English

A high-severity insufficient verification of data authenticity in OpenSign from OpenSignLabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 83.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.

Affected products (as reported)

Vendor	Product	Versions
OpenSignLabs	OpenSign	0 – through 2.37.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Project Repository