PT-2026-25091 · Oneuptime+3 · Oneuptime
N0Rv-Tvt
·
Published
2026-03-12
·
Updated
2026-03-13
·
CVE-2026-32598
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OneUptime versions prior to 10.0.24
Description
OneUptime, a service for monitoring and managing online services, has an issue in its password reset process. Before version 10.0.24, the complete password reset URL, including the plaintext reset token, was logged at the INFO level. This logging level is enabled by default in production environments. Anyone with access to application logs—such as those from log aggregation systems, Docker, or Kubernetes—could potentially intercept these tokens and take over user accounts. The vulnerable code is located in
App/FeatureSet/Identity/API/Authentication.ts lines 370-371, where the tokenVerifyUrl is logged. Additionally, login request data, including cleartext passwords, is logged at the DEBUG level on line 909. The tokenVerifyUrl takes the form of a complete URL like https://app.oneuptime.com/accounts/reset-password/<plaintext-token>. This issue allows for account takeover due to the systematic logging of every password reset request, potentially exposing all password reset tokens to individuals with log reader access.Recommendations
Versions prior to 10.0.24 should be updated to version 10.0.24 or later.
Exploit
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Oneuptime