CVE-2026-33143High· 7.5▾ TwilightOneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery status records, suppress alerts, and corrupt audit trails. The codebase already implements proper signature verification for Slack webhooks. This issue has been patched in version 10.0.34.
oneuptime < 10.0.34Upgrade past the affected range:
oneuptime 10.0.34Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33396Critical· 9.9OneUptime is an open-source monitoring and observability platform
CVE-2026-33142High· 8.1OneUptime is a solution for monitoring and managing online services
CVE-2026-32308High· 7.6OneUptime is a solution for monitoring and managing online services
CVE-2026-32598Medium· 6.5OneUptime is a solution for monitoring and managing online services
CVE-2026-32306Critical· 9.9OneUptime is a solution for monitoring and managing online services
CVE-2026-30957Critical· 9.9OneUptime is a solution for monitoring and managing online services