CVE-2026-32598: OneUptime Password Reset Token Exposed in Logs
Summary
CVE-2026-32598: OneUptime: Password Reset Token Logged at INFO Level. Affects oneuptime versions < 10.0.23. Fixed in 10.0.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OneUptime is an open-source platform designed for uptime monitoring and incident management. It provides features such as automated alerts, incident tracking, and user management. However, it has a vulnerability that exposes sensitive information, specifically password reset tokens, through application logs, potentially allowing unauthorized access to user accounts.
Vulnerability Detail
The vulnerability arises from the logging of the complete password reset URL, which includes the plaintext reset token, at the INFO log level. This logging is enabled by default in production environments, making it accessible to anyone with access to the application logs. The vulnerable code is located in the Authentication.ts file, where the reset password URL is logged. This exposure can lead to account takeover, as attackers can intercept these tokens and reset user passwords. Additionally, login credentials are logged at the DEBUG level, which, while typically disabled in production, may be enabled during troubleshooting, further increasing the risk of sensitive data exposure.
How To Fix
Latest published version: 4.0.69 as of 23 Oct 2026
npm install oneuptime@4.0.69Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.23
This is the first release that contains the fix.
npm install oneuptime@10.0.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the logging configuration to disable INFO level logging in production environments or implement log access controls to restrict who can view application logs. Additionally, avoid using DEBUG level logging during production unless necessary for troubleshooting.
Conclusion
CVE-2026-32598 is a significant vulnerability in OneUptime that exposes sensitive password reset tokens in application logs. It is crucial for users to update to the patched version to mitigate the risk of account takeover. Implementing logging best practices and using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for oneuptime →
FAQ
CVE-2026-32598 is a vulnerability in OneUptime that exposes password reset tokens in application logs, potentially allowing unauthorized users to take over accounts.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The main risk is account takeover, as attackers can intercept logged password reset tokens and reset user passwords, leading to unauthorized access.
If an immediate update is not possible, consider disabling INFO level logging in production and restricting access to application logs to mitigate the risk.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for oneuptime.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
