Oneuptime
CVE-2026-28787
HIGH
GHSA-gjjc-pcwp-c74m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid WebAuthn assertion via XSS or MitM
-
DeliveryCapture client-side challenge from response
-
ExploitReplay assertion with captured challenge
-
ExecutionBypass second-factor authentication
-
ImpactGain unauthorized account access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | OneUptime version 10.0.11 or prior with WebAuthn authentication enabled. Attacker requires: (1) authenticated session (PR:L), (2) ability to intercept/obtain valid WebAuthn assertion through XSS, man-in-the-middle, or exposed logs, (3) access to replaying assertion during subsequent authentication attempts. |
| Impact | CVSS 8.2 (HIGH). Attack vector: Network. Complexity: High. Privileges required: Low. User interaction: None. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OneUptime versions 10.0.11 and earlier contain an improper WebAuthn implementation where server-side challenge validation is missing, allowing attackers with a captured assertion to replay valid authentication tokens indefinitely and bypass multi-factor authentication. The vulnerability affects authenticated users and requires only low privileges to exploit, with public exploit code already available. No patches are currently available for this high-severity flaw.
Earlier versions of this analysis (1)
OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. [CVSS 8.2 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-287 (Improper Authentication). Affects Oneuptime. OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, §13.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to
Know when Oneuptime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, §13.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available.
Executive ViewAI
OneUptime versions 10.0.11 and prior contain a critical authentication bypass vulnerability that could allow attackers to forge WebAuthn credentials and gain unauthorized access to monitoring systems. Organizations using affected versions are exposed to account takeover and potential compromise of their service monitoring infrastructure, which may impact incident response capabilities and operational visibility.
Disable WebAuthn authentication entirely and enforce hardware security keys or TOTP-based MFA instead; implement network segmentation restricting OneUptime access to trusted IP ranges only; deploy Web Application Firewall (WAF) rules to monitor and block suspicious authentication patterns; enforce VPN/bastion host access requirements; implement real-time alerting on failed authentication attempts; require additional out-of-band verification for sensitive operations; increase frequency of access reviews and privilege audits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
OS command injection in OneUptime monitoring platform before 10.0.7. Authenticated users can execute arbitrary commands
OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality.
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
OneUptime monitoring platform prior to 10.0.18 allows code injection (CVSS 9.9) enabling RCE through the monitoring conf
OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.
OneUptime prior to 10.0.20 exposes dangerous functionality in Synthetic monitoring that enables code execution.
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.8), this vulnerability
Unauthenticated path traversal in OneUptime prior to 10.0.21 lets remote attackers read arbitrary files from the server
OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by
OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.3), this vulnerability
OneUptime is a solution for monitoring and managing online services. Rated medium severity (CVSS 6.9), this vulnerabilit
Remote command execution can be achieved by low-privileged authenticated users (ProjectMember role) in OneUptime monitor
Exploit-DB