What is the CVSS score of CVE-2026-30920?

CVE-2026-30920 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-30920?

Yes, a public proof-of-concept exploit is available for CVE-2026-30920. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30920?

Within 24 hours: Identify all OneUptime instances and their GitHub App integrations; disable GitHub App functionality if non-critical, and isolate OneUptime from production systems. Within 7 days: Audit all GitHub App installation changes and review unauthorized access logs; rotate GitHub tokens and review commit history for suspicious activity. Within 30 days: Monitor vendor advisories for patch availability; conduct full security assessment of affected systems and implement network segmentation between OneUptime and critical infrastructure.

Oneuptime CVE-2026-30920

HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-03-10 security-advisories@github.com

GHSA-656w-6f6c-m9r6

Github Oneuptime Hackerbay

8.6

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted GitHub App callback with forged state parameter
Delivery

Manipulate installation_id to target victim project
Exploit

Update gitHubAppInstallationId with isRoot: true
Execution

Enumerate repositories via compromised installation
Impact

Create CodeRepository records in arbitrary project

Vulnerability Assessment

Weakness	CWE CWE-345 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V15 - Secure Coding and Architecture Data authenticity verification
Exploitation Conditions	OneUptime versions prior to 10.0.19 with GitHub App integration enabled. Attacker must be able to send HTTP requests to the GitHub App callback endpoint. No authentication required; GitHub App callback endpoint accepts unauthenticated requests and fails to validate state parameter origin or installation_id authorization scope.
Impact	CVSS 8.6 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Public exploit/POC available.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to overwrite another project's GitHub App installation binding.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by exploiting insufficient validation in the OAuth callback handler, enabling them to redirect repository access and create code records in arbitrary projects. Public exploit code exists for this vulnerability, and GitHub and OneUptime users remain at risk until patches are applied, as no fixes are currently available for the affected GitHub integration.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 8.6

Oneuptime versions up to 10.0.19 is affected by insufficient verification of data authenticity (CVSS 8.6).

RemediationAI

Fixed in version 10.0.19.. Restrict network access to the affected service where possible.

Affected Packages

npm @oneuptime/common fix: 10.0.19

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-345: Insufficient Verification of Data Authenticity) affects Oneuptime. OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used

Know when Oneuptime gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 12, 2026 - 13:43 vuln.today

Public exploit code

CVE Published

Mar 10, 2026 - 17:40 nvd

HIGH 8.6

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19.

Executive ViewAI

Why It Matters

CVE-2026-30920 is a critical authorization bypass vulnerability in OneUptime that allows attackers to hijack GitHub App integrations across multiple projects without authentication. Organizations using OneUptime for service monitoring are at immediate risk of supply chain compromise, unauthorized code deployment, and potential data exfiltration through compromised GitHub integrations.

Business Impact: Severe

Compensating Controls

Disable OneUptime GitHub App integration until patch available; 2) Implement network segmentation to restrict OneUptime access to non-production systems; 3) Require manual authorization for any GitHub App installation changes; 4) Monitor GitHub audit logs for suspicious webhook activity and installation modifications; 5) Implement WAF rules to restrict access to OneUptime callback endpoints to authorized IP ranges only; 6) Consider temporary replacement with alternative monitoring solution without GitHub integration.

Threat Intelligence Overview

EPSS Score

0.0%

Top 100% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.