CVE-2026-72691: OpenSignLabs Auth Bypass Vulnerability

CVE-2026-72691 Overview

CVE-2026-72691 is an authentication bypass vulnerability in OpenSignLabs opensignserver through version 2.37.0. The flaw resides in the getsignedurl Parse cloud function, which skips its isAuthenticated check whenever any docId parameter is supplied. An unauthenticated remote attacker can mint MASTER_KEY-signed file access tokens for arbitrary stored files by supplying any string as docId, even one that does not correspond to a real document. The vulnerability is classified under [CWE-288] Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Unauthenticated remote attackers can generate MASTER_KEY-signed URLs granting access to arbitrary stored files in opensignserver deployments.

Affected Products

OpenSignLabs opensignserver through 2.37.0
Deployments exposing the getsignedurl Parse cloud function
Self-hosted OpenSign document signing installations

Discovery Timeline

2026-08-10 - CVE-2026-72691 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72691

Vulnerability Analysis

The vulnerability resides in the getsignedurl Parse cloud function within opensignserver. The function is intended to gate access behind an isAuthenticated check before minting signed URLs for stored files. Instead, the authentication gate is short-circuited whenever any docId parameter is present in the request.

Because the function does not validate whether the supplied docId corresponds to a real document, an attacker can pass an arbitrary string. The server then proceeds to issue a file access token signed with the Parse MASTER_KEY. These tokens grant privileged access to stored files, bypassing tenant and document ownership boundaries.

The impact is confidentiality-focused. Attackers obtain read access to arbitrary stored files, which for a document-signing platform typically includes contracts, personally identifiable information, and signed legal artifacts.

Root Cause

The root cause is a conditional authentication check that inverts its intended behavior. Rather than requiring authentication for all callers, the function treats the presence of docId as a signal to skip authentication. This design flaw maps to CWE-288, where an alternate request shape provides an unintended path around the authentication gate.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the Parse cloud function endpoint exposed by opensignserver, supplying any value for the docId parameter. The server responds with a MASTER_KEY-signed URL that can then be used to retrieve file contents directly.

See the OpenSign GitHub repository for source references to the affected getsignedurl cloud function.

Detection Methods for CVE-2026-72691

Indicators of Compromise

Unauthenticated requests to the getsignedurl Parse cloud function containing arbitrary or malformed docId values.
Server logs showing MASTER_KEY-signed URL issuance to sessions without a valid user token.
Bulk or sequential file download activity following calls to getsignedurl from a single external source.

Detection Strategies

Inspect Parse server logs for getsignedurl invocations lacking an associated authenticated session identifier.
Correlate signed-URL generation events with subsequent file retrievals from unexpected IP ranges or user agents.
Alert on docId values that do not match any document record in the application database.

Monitoring Recommendations

Enable verbose logging on Parse cloud function calls and forward events to a centralized log platform.
Monitor egress traffic from file storage backends for anomalous download volumes.
Track rate-of-issuance metrics for MASTER_KEY-signed URLs and alert on sudden increases.

How to Mitigate CVE-2026-72691

Immediate Actions Required

Restrict network exposure of the opensignserver Parse endpoint to trusted networks or place it behind an authenticating reverse proxy.
Audit recent getsignedurl invocations for suspicious docId values or unauthenticated callers.
Rotate the Parse MASTER_KEY if evidence of exploitation is present.

Patch Information

At time of publication, no fixed version beyond 2.37.0 is listed in the enriched CVE data. Monitor the OpenSign GitHub repository for a patched release and apply it as soon as it becomes available.

Workarounds

Modify the getsignedurl cloud function to enforce isAuthenticated unconditionally, regardless of whether docId is supplied.
Add server-side validation that the supplied docId maps to a real document owned by the requesting session.
Block unauthenticated requests to the Parse function endpoint at the reverse proxy or WAF layer.

bash

# Example reverse-proxy rule to require an auth header before reaching the endpoint
# nginx snippet
location /parse/functions/getsignedurl {
    if ($http_x_parse_session_token = "") {
        return 401;
    }
    proxy_pass http://opensignserver_upstream;
}