CVE-2026-30959— OneUptime has WhatsApp Resend Verification Authorization Bypass
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-30959
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OneUptime has WhatsApp Resend Verification Authorization Bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
OneUptime 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OneUptime是OneUptime开源的一个全面的解决方案。用于监控和管理您的在线服务。 OneUptime存在安全漏洞，该漏洞源于resend-verification-code端点所有权验证不足，可能导致验证码被恶意重发。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-30959
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-30959
请登录查看更多情报信息。
- Release 10.0.21 · OneUptime/oneuptime · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-30959
Same Patch Batch · OneUptime · 2026-03-10 · 4 CVEs total
| CVE-2026-30957 | 10.0 CRITICAL | OneUptime Synthetic Monitor RCE via exposed Playwright browser object |
| CVE-2026-30956 | 10.0 CRITICAL | OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header |
| CVE-2026-30958 | 7.2 HIGH | OneUptime: Path Traversal — Arbitrary File Read (No Auth) |
IV. Related Vulnerabilities
Same product: oneuptime
- CVE-2026-35053
OneUptime: Unauthenticated Workflow Execution via ManualAPI - CVE-2026-34840
OneUptime SSO: Multi-Assertion Identity Injection via Decoup - CVE-2026-34759
OneUptime: Unauthenticated notification API endpoints - fina - CVE-2026-34758
OneUptime: Missing Authentication on Notification Endpoints - CVE-2026-33396
OneUptime has sandbox escape in Synthetic Monitor Playwright
Same vendor: OneUptime
- CVE-2026-35053
OneUptime: Unauthenticated Workflow Execution via ManualAPI - CVE-2026-34840
OneUptime SSO: Multi-Assertion Identity Injection via Decoup - CVE-2026-34759
OneUptime: Unauthenticated notification API endpoints - fina - CVE-2026-34758
OneUptime: Missing Authentication on Notification Endpoints - CVE-2026-33396
OneUptime has sandbox escape in Synthetic Monitor Playwright
Same weakness: CWE-285
- CVE-2026-8241
Industrial Application Software IAS Canias ERP RMI iasGetSer - CVE-2026-42202
nova-toggle-5: Improper authorization on toggle endpoint all - CVE-2026-33823
Microsoft Team Events Portal Information Disclosure Vulnerab - CVE-2026-41572
Note Mark: Unauthenticated read of notes and assets in soft- - CVE-2026-7713
crocodilestick Calibre-Web-Automated Kobo auth-token Route k
V. Comments for CVE-2026-30959
No comments yet