CVE-2025-65966: Unauthorized User Creation in @oneuptime/common Package
Summary
CVE-2025-65966: OneUptime Unauthorized User Creation via API. Affects @oneuptime/common versions < 9.1.0. Fixed in 9.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @oneuptime/common package is a critical component of the OneUptime platform, which provides tools for uptime monitoring and incident management. This package facilitates user management and account creation functionalities. However, it has been identified that low-permission users can exploit the API to create unauthorized accounts, undermining the security and integrity of the system.
Vulnerability Detail
The vulnerability arises from improper access controls in the user-creation API endpoint, allowing low-permission users to send crafted requests and successfully create new accounts. This flaw can lead to unauthorized access, potential data breaches, and abuse of the platform's functionalities. The issue is classified under CWE-285, which pertains to improper authorization.
How To Fix
Minimum fixed version
9.1.0
This is the first release that contains the fix.
npm install @oneuptime/common@9.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict API access to the user-creation endpoint by implementing additional authentication checks or by disabling the endpoint until the package can be updated.
Conclusion
The CVE-2025-65966 vulnerability in the @oneuptime/common package poses a significant risk by allowing unauthorized user creation through the API. It is crucial to update to the patched version 9.1.0 to mitigate this risk and protect your application from potential abuse.
See every vulnerability recorded for @oneuptime/common →
FAQ
CVE-2025-65966 is a vulnerability in the @oneuptime/common package that allows low-permission users to create unauthorized accounts via a direct API request.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The vulnerability can lead to unauthorized account creation, which may result in data breaches, abuse of platform functionalities, and compromise of user data.
You can update the package by running the command: npm install @oneuptime/common@9.1.0 in your project directory.
Yes, you can restrict access to the user-creation endpoint by implementing additional authentication checks or disabling the endpoint until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for @oneuptime/common.
