Description

OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-17T21:16:49.610Z",
  "pubdate": "2026-08-17T21:16:49.610Z",
  "executiveSummary": "OpnForm suffers from an insecure secret generation vulnerability within its editable-submission mechanism, impacting unauthenticated remote users. The vulnerability stems from the derivation of editable-submission secrets directly from sequential row identifiers utilizing Hashids configured with an empty default salt. This cryptographic weakness enables unauthenticated threat actors to deterministically compute valid hashes corresponding to arbitrary database rows and form submissions.\nThe primary impact of this flaw includes both unauthorized data disclosure and integrity violation. Attackers possessing no privileges can successfully read sensitive response data belonging to other respondents by querying the submission-fetch endpoint with predicted identifiers. Furthermore, threat actors can perform unauthorized data modification or overwriting by supplying these predicted hashes to the answer endpoint.\nThe risk implications are severe for deployments utilizing default configurations, as the lack of a secure random salt completely invalidates the intended security boundary of the Hashids implementation. Exploitation requirements are minimal, as the predictable nature of sequential identifiers combined with the absence of authentication allows for automated, programmatic enumeration and exploitation at scale across exposed network interfaces.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the Hashids library within the OpnForm codebase to generate obfuscated identifiers for editable form submissions. Specifically, the application derives submission-editing secrets directly from internal, sequential row identifiers. Rather than utilizing a cryptographically secure pseudo-random number generator (CSPRNG) or a unique, high-entropy secret salt per installation, the implementation relies on an empty default salt value.\nHashids is designed to generate short, unique, reversible hashes from numbers, but it explicitly requires a unique and secret salt to prevent reverse-engineering and brute-forcing of the underlying integer values. By utilizing an empty default salt, the algorithm becomes entirely deterministic and reversible. An attacker can analyze the generated hash format and easily reverse or brute-force the mapping between the output hash and the sequential row identifier.\nThe exploitation flow proceeds as follows: First, an unauthenticated attacker identifies a target form managed by OpnForm. Second, because row identifiers are sequential integers, the attacker can systematically iterate through integer values (e.g., 1, 2, 3, ...) and compute or predict the corresponding Hashids output using the known empty salt configuration. Third, the attacker leverages the computed hashes against the application endpoints.\nTo read sensitive data, the attacker issues requests to the submission-fetch endpoint using the predicted hashes, bypassing authorization checks because the hash itself is treated as a sufficient bearer secret. To compromise data integrity, the attacker supplies the predicted hashes to the answer endpoint, enabling the injection of arbitrary payload data that overwrites legitimate respondent submissions. The vulnerable components include the submission-fetch endpoint, the answer endpoint, and the internal secret derivation logic. The vulnerability requires zero authentication or elevated privileges, and it is fully exposed over network interfaces where the affected OpnForm instance is hosted."
}