Description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.

INFO

Published Date :

2026-03-12T21:31:12.776Z

Last Modified :

2026-03-14T03:45:17.998Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-32598 vulnerability.

Vendors Products
Oneuptime
  • Oneuptime
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-32598.

URL Resource
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4524-cj9j-g4fj cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability