CVE-2026-32598Medium· 6.5▾ SunlitOneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default i…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.
oneuptime < 10.0.24Upgrade past the affected range:
oneuptime 10.0.24Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33396Critical· 9.9OneUptime is an open-source monitoring and observability platform
CVE-2026-33142High· 8.1OneUptime is a solution for monitoring and managing online services
CVE-2026-33143High· 7.5OneUptime is a solution for monitoring and managing online services
CVE-2026-32308High· 7.6OneUptime is a solution for monitoring and managing online services
CVE-2026-32306Critical· 9.9OneUptime is a solution for monitoring and managing online services
CVE-2026-30957Critical· 9.9OneUptime is a solution for monitoring and managing online services