What is the CVSS score of CVE-2026-34840?

CVE-2026-34840 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Jwt Attack are affected by CVE-2026-34840?

CVE-2026-34840 is a high-severity authentication bypass in OneUptime's SAML SSO implementation that allows authenticated users to impersonate arbitrary accounts through XML signature verification…. A patch is available.

How to fix or mitigate CVE-2026-34840?

Within 24 hours: Inventory all OneUptime deployments and confirm current versions; notify security and identity teams of exposure scope. Within 7 days: Upgrade OneUptime to version 10.0.42 or later across all affected instances; verify SAML SSO functionality post-upgrade. Within 30 days: Conduct access log review for the past 90 days to identify suspicious user impersonation patterns; validate that identity extraction and signature validation are now coupled in SAML assertion processing.

Jwt Attack CVE-2026-34840

EUVD-2026-18533 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-04-02 GitHub_M

Authentication Bypass Jwt Attack

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:08 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.42

EUVD ID Assigned

Apr 02, 2026 - 19:31 euvd

EUVD-2026-18533

Analysis Generated

Apr 02, 2026 - 19:31 vuln.today

CVE Published

Apr 02, 2026 - 18:52 nvd

HIGH 8.1

DescriptionGitHub Advisory

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/FeatureSet/Identity/Utils/SSO.ts) has decoupled signature verification and identity extraction. isSignatureValid() verifies the first <Signature> element in the XML DOM using xml-crypto, while getEmail() always reads from assertion[0] via xml2js. An attacker can prepend an unsigned assertion containing an arbitrary identity before a legitimately signed assertion, resulting in authentication bypass. This issue has been patched in version 10.0.42.

AnalysisAI

Authentication bypass in OneUptime SAML SSO implementation allows authenticated attackers to impersonate arbitrary users by exploiting XML signature verification logic flaws. Affected versions prior to 10.0.42 decouple signature validation from identity extraction, enabling XML injection attacks where an unsigned assertion with attacker-controlled identity precedes a legitimately signed assertion. EPSS and exploitation signals indicate publicly available exploit code exists with moderate technical complexity (CVSS AC:L, PR:L). No confirmed active exploitation (not in CISA KEV).

Technical ContextAI

OneUptime (cpe:2.3:a:oneuptime:oneuptime) is an open-source observability platform. The vulnerability stems from CWE-347 (Improper Verification of Cryptographic Signature) in the SAML SSO implementation located in App/FeatureSet/Identity/Utils/SSO.ts. The code uses xml-crypto to verify the first <Signature> element in the XML DOM tree via isSignatureValid(), while identity extraction through getEmail() uses xml2js to always parse assertion[0] without verifying which assertion was cryptographically signed. This architectural flaw creates a race condition where XML processing order differs between verification and extraction phases. SAML (Security Assertion Markup Language) relies on XML digital signatures to ensure assertion integrity, but improper implementation of signature scope validation enables XML signature wrapping attacks-a well-documented attack class against SAML implementations that parse XML without enforcing signature coverage over extracted claims.

RemediationAI

Vendor-released patch: upgrade to OneUptime version 10.0.42 or later, released on the project's GitHub repository at https://github.com/OneUptime/oneuptime/releases/tag/10.0.42. The fix implemented in commit 2fd7ede52f60444710628d6c1b34dee2ef9e57d1 (https://github.com/OneUptime/oneuptime/commit/2fd7ede52f60444710628d6c1b34dee2ef9e57d1) corrects the signature verification logic to ensure cryptographic validation applies to the same assertion from which identity claims are extracted, eliminating the XML injection opportunity. No workarounds are documented in the advisory; upgrading is the sole remediation path. Organizations should prioritize patching SAML SSO-enabled instances immediately. For environments where immediate patching is infeasible, consider temporarily disabling SAML SSO and reverting to alternative authentication mechanisms until upgrade completion, though this introduces operational disruption.