PT-2026-26199 · Oneuptime · Oneuptime

N0Rv-Tvt · Published 2026-03-18 · Updated 2026-03-24 · CVE-2026-33143

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.34

Description OneUptime, a service monitoring solution, had a critical issue in its WhatsApp POST webhook handler (/notification/whatsapp/webhook). This handler did not verify the Meta/WhatsApp X-Hub-Signature-256 HMAC signature for incoming status update events. This allowed unauthenticated attackers to forge webhook payloads, potentially manipulating notification delivery status records, suppressing alerts, and corrupting audit trails. The Slack webhook handler within the same codebase correctly implements signature verification. An attacker could exploit this by sending crafted POST requests to the /notification/whatsapp/webhook endpoint without providing a valid signature. This could lead to false delivery status reports, suppression of critical alerts, and manipulation of audit logs. The vulnerable code resides in App/FeatureSet/Notification/API/WhatsApp.ts lines 372-430.

Recommendations Versions prior to 10.0.34 should be updated to version 10.0.34 or later to address the missing signature verification in the WhatsApp POST webhook handler.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-33143

GHSA-G5PH-F57V-MWJC

Affected Products

Oneuptime

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33143.json · Exploit
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-g5ph-f57v-mwjc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33143 · Security Note
• https://osv.dev/vulnerability/GHSA-g5ph-f57v-mwjc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33143 · Vendor Advisory
• https://github.com/OneUptime/oneuptime · Note
• https://twitter.com/dailycve/status/2036286261011386688 · Twitter Post
• https://twitter.com/CVEnew/status/2035262161178558879 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035262936487166025 · Twitter Post