CVE-2026-30959
CVE-2026-30959 · OneUptime has WhatsApp Resend Verification Authorization Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
oneuptime
- Versions
- < 10.0.21: Affected
No fix published
@oneuptime/common npm
- Affected ranges
- SEMVER: < 10.0.21
Update to 10.0.21