CVE-2026-28675

low-risk

Published 2026-03-06

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, some endpoints returned raw exception strings to clients. Additionally, login token material was exposed in UI/rendered responses and token rotation output. This issue has been patched in version 1.6.3-alpha.

Do I need to act?

0.04% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Opensift

Affected Vendors

Opensift

References (5)

Patch https://github.com/OpenSift/OpenSift/commit/1126e0a503876056a68a434e19f64158a5a4...

Patch https://github.com/OpenSift/OpenSift/commit/de99b9c

Issue Tracking https://github.com/OpenSift/OpenSift/pull/67

Release Notes https://github.com/OpenSift/OpenSift/releases/tag/v1.6.3-alpha

Vendor Advisory https://github.com/OpenSift/OpenSift/security/advisories/GHSA-667g-rvcj-w976

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal