CVE-2025-11438: JhumanJ OpnForm Auth Bypass Vulnerability

CVE-2025-11438 Overview

CVE-2025-11438 is a missing authorization vulnerability in JhumanJ OpnForm through version 1.9.3. The flaw resides in the /custom-domains API endpoint, which fails to enforce proper authorization checks on incoming requests. Authenticated users with low privileges can manipulate the endpoint remotely to access or modify resources they should not control. The issue is tracked under CWE-862: Missing Authorization. A public disclosure includes exploitation details, and the maintainer has published a patch identified by commit beb153ce52dceb971c1518f98333328c95f1ba20.

Critical Impact
Remote attackers with low-level authentication can invoke the /custom-domains API without proper authorization, affecting the confidentiality, integrity, and availability of form data and domain configuration.

Affected Products

JhumanJ OpnForm versions up to and including 1.9.3
OpnForm /custom-domains API endpoint component
Self-hosted OpnForm deployments running vulnerable builds

Discovery Timeline

2025-10-08 - CVE-2025-11438 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11438

Vulnerability Analysis

OpnForm is an open-source form builder written primarily in Laravel and Vue. The application exposes an API endpoint at /custom-domains that manages custom domain configuration for user-created forms. In versions up to 1.9.3, this endpoint does not verify that the requesting user is authorized to operate on the target resource. An authenticated attacker can issue requests against the endpoint and act on domain records outside their permission scope. The impact spans confidentiality, integrity, and availability, though each dimension is limited in scope per the assigned CVSS 4.0 metrics.

Root Cause

The root cause is a missing authorization check in the controller responsible for the /custom-domains endpoint. The handler validates authentication but omits an ownership or role check before performing the requested operation. This maps directly to CWE-862, where the application performs a sensitive action without verifying the actor is entitled to perform it. The corrective patch in commit beb153ce52dceb971c1518f98333328c95f1ba20 introduces the missing authorization logic.

Attack Vector

Exploitation requires network access to the OpnForm API and a valid low-privilege account. The attacker sends a crafted HTTP request to /custom-domains targeting a resource belonging to another tenant or workspace. No user interaction is required, and the attack complexity is low. Because the exploitation technique has been publicly disclosed, defenders should assume opportunistic scanning against exposed OpnForm instances.

Refer to the OpnForm patch commit and the VulDB entry #327375 for technical details of the vulnerable code path and the fix.

Detection Methods for CVE-2025-11438

Indicators of Compromise

Unexpected HTTP requests to the /custom-domains endpoint originating from low-privileged user sessions.
Custom domain records created, modified, or deleted by accounts that do not own the associated workspace or form.
API access logs showing repeated /custom-domains calls with varying resource identifiers, consistent with enumeration.

Detection Strategies

Enable verbose API access logging on the OpnForm web tier and correlate requests to /custom-domains with the authenticated user identifier and target resource owner.
Alert on any state-changing HTTP method (POST, PUT, PATCH, DELETE) against /custom-domains where the acting user is not the resource owner.
Baseline normal custom domain administration activity per workspace and flag deviations for review.

Monitoring Recommendations

Forward reverse proxy and application logs to a centralized analytics platform for retention and query at scale.
Monitor authentication logs for accounts issuing unusually broad API calls following successful login.
Track configuration drift on custom domain records to detect unauthorized modifications quickly.

How to Mitigate CVE-2025-11438

Immediate Actions Required

Upgrade OpnForm to a release that includes patch commit beb153ce52dceb971c1518f98333328c95f1ba20 or later.
Audit existing custom domain records for entries created or modified by unauthorized accounts.
Rotate API tokens and session credentials if unauthorized /custom-domains activity is identified in logs.

Patch Information

The maintainer JhumanJ has released a fix in pull request 900, commit beb153ce52dceb971c1518f98333328c95f1ba20. The patch adds the missing authorization check to the /custom-domains handler. Administrators should pull the latest OpnForm release from the official repository and redeploy. Verify the running version after upgrade and confirm the patch is present in the deployed code.

Workarounds

Restrict network access to the OpnForm API using an upstream reverse proxy or web application firewall until the patch is applied.
Temporarily disable the /custom-domains route at the proxy layer if custom domains are not in use.
Reduce the number of low-privilege accounts with API access to limit the pool of potential abusers.

bash

# Example nginx rule to block the endpoint until patching completes
location = /custom-domains {
    deny all;
    return 403;
}