Description

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T13:20:39.350Z",
  "pubdate": "2026-08-10T13:20:39.350Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified in OpenSignLabs opensignserver through version 2.37.0. The vulnerability resides in the Parse cloud function named getsignedurl, which improperly handles access control validation.\nSpecifically, the affected function completely skips its internal isAuthenticated check whenever any docId parameter is supplied by a client, even if the provided string corresponds to a non-existent or invalid document.\nThis design flaw allows an unauthenticated remote attacker to bypass the authentication gate entirely by supplying an arbitrary string value within the docId parameter.\nUpon successful exploitation, an unauthorized malicious actor can mint cryptographic file access tokens signed with the MASTER_KEY. These forged tokens grant the attacker unauthorized access to arbitrary stored files within the system.\nThe risk implications are severe, as unauthorized data exposure and potential retrieval of sensitive documents can be achieved remotely over the network without requiring any prior credentials or privileged access.\nExploitation requirements are minimal, requiring only network reachability to the vulnerable Parse cloud function endpoint and the injection of a crafted parameter payload.",
  "technicalDetails": "The vulnerability is an authentication bypass flaw affecting OpenSignLabs opensignserver versions up to and including 2.37.0. The vulnerable component is the Parse cloud function identified by the name getsignedurl.\nThe root cause of the vulnerability stems from flawed conditional logic within the function implementation regarding session validation. The function is designed to enforce access control by verifying whether a user session is authenticated via an isAuthenticated check.\nHowever, the authorization logic contains a conditional bypass condition: the isAuthenticated check is skipped entirely whenever any docId parameter is present in the incoming request. The application fails to validate whether the supplied docId maps to a legitimate, existing document or whether the requesting entity possesses valid permissions to access it.\nBecause the function accepts any arbitrary string as the docId parameter and uses its mere presence to bypass security checks, an unauthenticated remote attacker can easily subvert the authentication gate.\nThe attack flow proceeds as follows: First, the unauthenticated remote attacker interacts with the exposed Parse cloud function endpoint for getsignedurl over the network. Second, the attacker crafts a malicious request containing an arbitrary string as the docId parameter. Third, the backend server processes the request, evaluates the flawed conditional statement, incorrectly evaluates the presence of the docId parameter, and bypasses the isAuthenticated security check.\nFourth, the vulnerable function proceeds to generate and issue a file access token signed with the internal MASTER_KEY for the requested target. Finally, the attacker leverages the minted MASTER_KEY-signed token to gain unauthorized access to arbitrary stored files on the server.\nThe network exposure is remote, allowing external adversaries to interact directly with the application endpoints. No authentication or privilege requirements are needed to initiate the attack, as the vulnerability explicitly bypasses these security controls.\nThe post-exploitation impact includes the potential unauthorized disclosure and retrieval of sensitive files stored within the opensignserver ecosystem, undermining the confidentiality and integrity of the managed document repository."
}