CVE-2026-28787: OneUptime WebAuthn 2FA Bypass Vulnerability
Summary
CVE-2026-28787: The WebAuthn authentication implementation does not store the challenge on the server side. Affects @oneuptime/common versions < 10.0.11. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OneUptime is an open-source platform that provides various services for uptime monitoring and incident management. It utilizes WebAuthn for two-factor authentication (2FA), enhancing security by requiring a second factor beyond just a password. However, a critical vulnerability has been identified in its WebAuthn implementation, which allows attackers to bypass 2FA protections.
Vulnerability Detail
The vulnerability arises from the WebAuthn authentication process, where the server fails to store the challenge generated during authentication. Instead, it returns the challenge to the client and accepts it back from the client request during verification. This design flaw violates the WebAuthn specification and allows attackers who have captured a valid WebAuthn assertion to replay it indefinitely, effectively bypassing the second-factor authentication. The lack of server-side challenge storage means that once an attacker has both the victim's password and a single captured assertion, they can authenticate as the victim without needing the authenticator device.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling WebAuthn 2FA until the package is updated. This can be done by changing the authentication settings in your OneUptime account to use only password-based authentication.
Conclusion
The CVE-2026-28787 vulnerability in OneUptime's WebAuthn implementation poses a significant risk by allowing attackers to bypass 2FA protections. It is crucial for users to update to the patched version of the package and consider temporary workarounds until the update can be applied. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security.
See every vulnerability recorded for @oneuptime/common →
FAQ
The vulnerability allows attackers to bypass WebAuthn 2FA by replaying captured authentication assertions due to the server not storing the challenge.
Any OneUptime user who has enrolled WebAuthn/Passkey as their second factor is at risk.
You can use Vulert's playground at Vulert Scanner to monitor and check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
If immediate updates are not possible, consider disabling WebAuthn 2FA as a temporary measure to protect your account.
References
Related vulnerabilities
Recent vulnerabilities recorded for @oneuptime/common.
