OpnForm Predictable Submission Secret Vulnerability

OpnForm has a predictable submission-secret vulnerability because it derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt.

Unauthenticated attackers can compute hashes for any submission, allowing them to:

• Read other respondents' full submission data through the submission-fetch endpoint
• Overwrite submissions by supplying predicted hashes to the answer endpoint