Skip to content
OpenAdvisories

Package · npm

@oneuptime/common

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.6
    CVE-2026-30920

    OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

    OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating…

    OneUptime oneuptime @oneuptime/common npm
  • High 8.2
    CVE-2026-28787

    OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay

    OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back f…

    OneUptime oneuptime @oneuptime/common npm
  • High 8.8
    CVE-2025-65966

    OneUptime Unauthorized User Creation via API

    OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version …

    OneUptime oneuptime @oneuptime/common npm