External risk intelligence

OpnForm Editable Submission Secrets Exposed Via Empty Hashids Salt

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75106

OpnForm is a form-building application designed to receive submissions from end users. The vulnerable endpoints are public-facing web API interfaces intended to be accessible to the internet to facilitate data collection, making the exposed surface reachable by design in normal deployment scenarios.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in OpnForm affects its ability to securely handle submission data. It allows unauthenticated access to sensitive information and the potential to alter submissions by exploiting a weakness in how submission secrets are generated. The main concern is confirming relevance and exposure.

Predictable submission secrets expose user data.
Unauthenticated access to submissions is possible.
Verify if this form-building software is used.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can compute valid submission identifiers for OpnForm by leveraging a weakness in how editable submission secrets are generated. This allows the attacker to access or alter other users' submitted data.

No authentication or special access needed.
Submit predictable hash to answer endpoint.
Read and overwrite submission data.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers can compute editable-submission secrets. This could allow them to read other respondents' full submission data or overwrite submissions by predicting submission hashes.

Submission data and content at risk.
Predictable hashes expose sensitive information.
Unauthorized data modification or access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpnForm application's handling of submission secrets makes it a potential concern for platform teams or application owners responsible for the form service. The first practical step is to identify all instances of OpnForm, assess their reachability and criticality, and then engage the accountable owner to plan remediation.

Application owners should address this.
Verify OpnForm instances and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpnForm?

OpnForm is an open-source form-building platform that allows users to create custom forms and collect data. It is widely used by organizations to gather, manage, and process submissions from end users via web interfaces. Because it is designed to facilitate external data collection, it is typically hosted as a web application that must remain reachable to the public internet to function as intended.

How does CVE-2026-75106 create a vulnerability?

This flaw is classified as CWE-340: Generation of Predictable Numbers. OpnForm relies on the Hashids library to create secrets that authorize users to edit their submissions. Because the software uses an empty default salt during this generation process, these secrets become predictable. An attacker can use this weakness to calculate the valid identifiers for any submission without needing the original user's permission.

Do I need special access to trigger CVE-2026-75106?

No. The vulnerability does not require authentication or elevated privileges to exploit. An attacker simply needs to interact with the application's public-facing submission endpoints. Note that the bug is triggered by the predictable nature of the hash calculation itself; it is not dependent on a specific user action or a misconfiguration of the server environment, but rather a flaw in the application's core logic for securing submission access.

Why is my OpnForm instance at risk?

According to Halo Surface Signal, OpnForm instances are generally categorized as external-facing assets because they are built to receive submissions from the internet. This means the vulnerable API endpoints are reachable by design in most standard deployments. If your instance is accessible to the public, an attacker can leverage this accessibility to reach the compromised endpoints and read or modify sensitive respondent data.

What is the first step to address this issue?

You should begin by performing an inventory of all OpnForm instances running within your infrastructure to identify which versions are in use. Once identified, evaluate the reachability and criticality of each deployment. Coordinate with the platform owners or teams responsible for these services to prioritize remediation and ensure that any necessary security updates or configuration changes are applied to secure your submission data.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.