Oneuptime CVE-2026-28787
HIGH
GHSA-gjjc-pcwp-c74m
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 1 npm packages depend on @oneuptime/common (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 10.0.11.
DescriptionNVD
OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, §13.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available.
AnalysisAI
OneUptime versions 10.0.11 and earlier contain an improper WebAuthn implementation where server-side challenge validation is missing, allowing attackers with a captured assertion to replay valid authentication tokens indefinitely and bypass multi-factor authentication. The vulnerability affects authenticated users and requires only low privileges to exploit, with public exploit code already available. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all OneUptime deployments and document affected versions; restrict administrative access and monitor authentication logs for suspicious activity. Within 7 days: Disable WebAuthn authentication if possible and require alternative MFA methods; isolate OneUptime instances to trusted networks only; implement enhanced logging of all authentication attempts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today