Oneuptime CVE-2026-34840

OneUptime versions prior to 10.0.42 with SAML SSO enabled. Attacker must be an authenticated user who can craft and submit a malicious SAML response containing a prepended unsigned assertion before a legitimately signed assertion. Remote network access required; no victim interaction needed.

Real-world risk assessment reveals moderate-to-high priority requiring expedited patching. CVSS 8.1 (High) reflects network attack vector (AV:N), low complexity (AC:L), and high confidentiality/integrity impact (C:H/I:H) with no availability impact (A:N). However, exploitation requires low-privileged authentication (PR:L), reducing attack surface compared to unauthenticated vulnerabilities. SSVC framework confirms publicly available exploit code exists (Exploitation: poc) with total technical impact but non-automatable attacks, suggesting targeted exploitation scenarios rather than mass scanning. The attack requires crafting malformed SAML responses with prepended unsigned assertions-feasible for sophisticated attackers but not script-kiddie accessible. JWT Attack and Authentication Bypass tags indicate this enables lateral movement and privilege escalation in SSO-integrated environments. While not in CISA KEV (no confirmed active exploitation), the combination of public POC, SSO context (high-value target), and straightforward patch availability elevates priority. Organizations using OneUptime SAML SSO should treat this as urgent; those without SAML SSO enabled face minimal risk.

An authenticated attacker with low-privilege access to a OneUptime instance configured with SAML SSO intercepts or crafts a SAML response during authentication flow. The attacker prepends an unsigned SAML assertion containing a fabricated identity (e.g., admin@targetdomain.com) before a legitimately signed assertion obtained from a valid SSO session. When OneUptime processes this malformed SAML response, isSignatureValid() verifies the signature on the second (legitimate) assertion and returns true, while getEmail() extracts identity from assertion[0] (the unsigned, attacker-controlled assertion). The attacker successfully authenticates as the fabricated identity, bypassing authorization controls and gaining administrative access to monitoring dashboards, observability data, and system configurations. Publicly available exploit code exists demonstrating this XML signature wrapping technique, making execution feasible for attackers familiar with SAML protocol mechanics.