Read the docs
TI-2026-22982 Aliases CVE-2026-28787GHSA-gjjc-pcwp-c74m

Improper authentication in oneuptime

Priority HIGH 74CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, §13.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OneUptimeoneuptimeup to 10.0.11—No fix listedCNA
—@oneuptime/common (npm)up to 10.0.11—No fix listedGHSA-gjjc-pcwp-c74m
  • oneuptime VendorOneUptime Affected up to 10.0.11 Fixed in — No fix listed CNA
  • @oneuptime/common (npm) Vendor— Affected up to 10.0.11 Fixed in — No fix listed GHSA-gjjc-pcwp-c74m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*up to 10.0.11VulnerableOneUptime
  • cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:* Versions up to 10.0.11 Vulnerable ·OneUptime

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28787
  2. 2026-10-03 Alias added: GHSA-gjjc-pcwp-c74m

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-22090 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVSS 3.1CRITICAL 10.0
  • TI-2026-27002 OneUptime: Missing Authentication on Notification Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-25573 OneUptime: WhatsApp Webhook Missing Signature Verification CVSS 4.0HIGH 8.7
  • TI-2025-40534 OneUptime Unauthorized User Creation via API CVSS 4.0HIGH 8.8
  • TI-2026-25793 Protection mechanism failure in oneuptime CVSS 3.1CRITICAL 10.0
  • TI-2026-24835 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVSS 3.1CRITICAL 10.0
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences