Sign in
Deutsch English Español Polski
High

OneUptime Unauthorized User Creation via API

  • Disclosed: 26.11.2025
  • Updated: 11.10.2026 10:22

Summary

A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.

PoC

A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully. WhatsApp Image 2025-11-23 at 14 27 32_0e0f5889

Impact

This allows attackers to create unauthorized accounts.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package @oneuptime/common < 9.1.0 9.1.0

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-285
Platform
npm
Package
@oneuptime/common
Disclosed
26.11.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-m449-vh5f-574g - CC BY 4.0

Vulnerability history: @oneuptime/common

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (11) in the archive
Total entries
11
First → latest
11.2025 03.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 6
  • High 3
  • Medium 2

Disclosures per year

Severity:
  1. OneUptime has Synthetic Monitor RCE via exposed Playwright browser object
    Critical · 9.9 CVE-2026-30957 < 10.0.21 10.0.21
  2. OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
    Critical · 9.9 CVE-2026-30956 < 10.0.21 10.0.21
  3. OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
    High · 8.6 CVE-2026-30920 < 10.0.19 10.0.19
  4. OneUptime: Synthetic Monitor RCE via exposed Playwright browser object
    Critical · 9.9 CVE-2026-30921 < 10.0.20 10.0.20
  5. OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
    Critical · 9.9 CVE-2026-30887 < 10.0.18 10.0.18
  6. OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
    High · 8.2 CVE-2026-28787 <= 10.0.11 no fix
  7. OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
    Critical · 9.9 CVE-2026-27728 < 10.0.7 10.0.7
  8. OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
    Critical · 9.9 CVE-2026-27574 < 10.0.0 10.0.0
  9. OneUptime Unauthorized User Creation via API this entry
    High CVE-2025-65966 < 9.1.0 9.1.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.