CVE-2026-72544: OpenSign Auth Bypass Vulnerability

CVE-2026-72544 Overview

CVE-2026-72544 is an integrity verification vulnerability [CWE-345] affecting OpenSignLabs OpenSign through version 2.37.0. The flaw resides in the triggerevent Parse cloud function, which accepts viewer identity and IP address as caller-supplied parameters without authentication. Unauthenticated remote attackers can forge audit-trail entries for any signed document. This undermines the non-repudiation guarantees that document-signing platforms are built to provide.

Critical Impact
Attackers can fabricate arbitrary audit log entries on the legal audit trail of any signed document, compromising evidentiary integrity without authentication.

Affected Products

OpenSignLabs OpenSign versions through 2.37.0
Deployments exposing the Parse Server triggerevent cloud function
Self-hosted OpenSign instances reachable over the network

Discovery Timeline

2026-08-11 - CVE-2026-72544 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72544

Vulnerability Analysis

OpenSign uses a Parse Server backend that exposes a cloud function named triggerevent. This function records audit-trail entries when signers view or interact with documents. The audit trail is the authoritative record used to demonstrate who saw or signed a document and when.

The function trusts caller-supplied input to describe the acting party. Both the viewer identity and the source IP address are passed as parameters instead of being derived server-side from an authenticated session or the TCP connection. No authentication check gates the call.

By invoking triggerevent directly, an attacker can inject fake Viewed, Signed, or similar entries against any document identifier. Forged entries are indistinguishable from legitimate ones once persisted, breaking non-repudiation for signed documents.

Root Cause

The root cause is insufficient verification of data authenticity [CWE-345]. The triggerevent handler does not require session context and does not cross-check caller-provided identity against the authenticated user or the request's actual network origin.

Attack Vector

Exploitation requires only network reachability to the OpenSign Parse Server endpoint. An attacker sends an HTTP request to the Parse /functions/triggerevent route with attacker-chosen values for the viewer identity and IP fields. No credentials, user interaction, or privileges are needed. See the OpenSign project repository for implementation details.

Detection Methods for CVE-2026-72544

Indicators of Compromise

Audit-trail entries whose recorded IP address does not match web server or reverse proxy access logs for the same timestamp
triggerevent invocations lacking a valid authenticated session token or originating from unexpected user agents
Duplicate or out-of-sequence audit entries against a single document identifier

Detection Strategies

Correlate Parse Server cloud function invocations with upstream reverse proxy logs to identify identity or IP mismatches
Alert on triggerevent calls that reference document IDs the caller has no prior authorization history with
Baseline the normal ratio of view events to signer sessions and flag statistical outliers

Monitoring Recommendations

Enable verbose logging on the Parse Server cloud functions layer and forward to a central log store
Monitor outbound audit-trail export operations for entries created shortly after suspicious triggerevent traffic
Retain raw HTTP access logs long enough to reconstruct audit-trail provenance during legal disputes

How to Mitigate CVE-2026-72544

Immediate Actions Required

Restrict network access to the OpenSign Parse Server so the triggerevent endpoint is not exposed to untrusted networks
Audit existing audit trails for entries whose recorded IP does not correlate with proxy or CDN access logs
Upgrade to a fixed release of OpenSign once published by OpenSignLabs

Patch Information

At the time of publication, no fixed version is listed in the CVE record. Monitor the OpenSign project repository for a release addressing the triggerevent authentication gap, and apply the update to all self-hosted instances.

Workarounds

Place a reverse proxy or WAF in front of Parse Server that rejects unauthenticated calls to /functions/triggerevent
Modify the deployment to require a valid Parse session token for the triggerevent handler and derive the viewer IP from the request socket rather than the request body
Disable the triggerevent cloud function if it is not required for the deployment's workflow

bash

# Example nginx rule to block unauthenticated triggerevent calls
location /parse/functions/triggerevent {
    if ($http_x_parse_session_token = "") {
        return 401;
    }
    proxy_pass http://parse_backend;
}