What is the CVSS score of CVE-2026-34758?

CVE-2026-34758 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oneuptime are affected by CVE-2026-34758?

OneUptime versions below 10.0.42 contain a critical authentication bypass in notification and phone management endpoints that allows unauthenticated attackers to hijack SMS, voice, email, and…. A patch is available.

How to fix or mitigate CVE-2026-34758?

Within 24 hours: Identify all OneUptime instances and document current versions in use; isolate affected systems from untrusted networks if version <10.0.42. Within 7 days: Apply vendor-released patch upgrading to OneUptime 10.0.42 or later on all instances; validate patch deployment and test notification/phone endpoints. Within 30 days: Conduct audit of notification and messaging logs from 90 days prior to patch date for unauthorized SMS/voice/email/WhatsApp activity; reset all phone numbers and associated credentials; review billing records for unauthorized phone number purchases.

Oneuptime CVE-2026-34758

EUVD-2026-18511 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-04-02 GitHub_M

Authentication Bypass Oneuptime

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:46 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.42

EUVD ID Assigned

Apr 02, 2026 - 19:01 euvd

EUVD-2026-18511

Analysis Generated

Apr 02, 2026 - 19:01 vuln.today

CVE Published

Apr 02, 2026 - 18:49 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.

AnalysisAI

Unauthenticated access to notification and phone management endpoints in OneUptime <10.0.42 allows remote attackers to abuse SMS, voice call, email, and WhatsApp messaging services and purchase phone numbers without authentication. The CVSS 9.1 (Critical) rating reflects network-accessible attack vector with no authentication required (PR:N) and low complexity (AC:L), enabling immediate abuse of platform communication services and potential financial fraud. Vendor-released patch available in version 10.0.42. No public exploit identified at time of analysis, though EPSS risk assessment would likely be elevated given the simplicity of exploitation and clear abuse potential.

Technical ContextAI

OneUptime is a comprehensive open-source monitoring and observability platform designed for infrastructure and application monitoring with integrated notification capabilities. This vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where API endpoints responsible for testing notification channels (SMS, voice calls, email, WhatsApp) and managing phone number resources lack authentication enforcement. The affected CPE (cpe:2.3:a:oneuptime:oneuptime) indicates the core platform application is vulnerable. The CVSS vector indicates these endpoints are exposed over the network (AV:N) with no authentication barrier (PR:N), allowing any remote actor to invoke notification tests or phone number procurement functions. The underlying issue represents a common authentication bypass pattern in API design where administrative or resource-intensive operations are inadvertently exposed without proper access control validation.

RemediationAI

Upgrade immediately to OneUptime version 10.0.42 or later, which contains the authentication enforcement fix. The vendor-released patch is available via the official GitHub release at https://github.com/OneUptime/oneuptime/releases/tag/10.0.42, with the specific security fix implemented in commit 9adbd04538714740506708d6fa610e433be4d2a4 (https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4). No workarounds are provided in the advisory; patching is the only effective remediation. Organizations should prioritize this upgrade to prevent unauthorized access to notification endpoints and phone number management functions. After upgrading, review platform logs for any suspicious notification test activity or unauthorized phone number purchases that may have occurred during the vulnerability window. Refer to the GitHub Security Advisory GHSA-q253-6wcm-h8hp for complete vendor guidance.