CVE-2026-33143: OneUptime WhatsApp Webhook Missing Signature Verification Vulnerability
Summary
CVE-2026-33143: OneUptime WhatsApp Webhook Missing Signature Verification. Affects oneuptime versions < 10.0.34. Fixed in 10.0.34. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OneUptime is an open-source incident management platform that provides tools for monitoring and managing notifications across various channels, including WhatsApp. It allows users to receive alerts and updates about system statuses and incidents. However, a critical vulnerability has been identified in its WhatsApp webhook handling, which processes incoming status updates without verifying the authenticity of the messages received.
Vulnerability Detail
The vulnerability arises from the WhatsApp POST webhook handler that processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature. This oversight allows unauthenticated attackers to send forged webhook payloads, potentially manipulating notification delivery statuses, suppressing alerts, and corrupting audit trails. The absence of signature verification exposes the system to various risks, including false delivery statuses, alert suppression, log manipulation, and disruption of incident response efforts.
How To Fix
Latest published version: 4.0.69 as of 23 Oct 2026
npm install oneuptime@4.0.69Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.0.34
This is the first release that contains the fix.
npm install oneuptime@10.0.34Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned to mitigate this vulnerability without applying the patch. However, it is advisable to restrict access to the webhook endpoint until the update is applied.
Conclusion
The CVE-2026-33143 vulnerability in OneUptime poses significant risks due to the lack of signature verification in the WhatsApp webhook handler. It is crucial for users to update to version 10.0.34 or later to secure their applications against potential exploitation.
See every vulnerability recorded for oneuptime →
FAQ
The vulnerability is a missing signature verification in the WhatsApp webhook handler, allowing attackers to send forged payloads.
Attackers can manipulate delivery statuses, suppress alerts, and corrupt audit trails, leading to significant operational risks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
While there are no specific workarounds, it is recommended to restrict access to the webhook endpoint until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for oneuptime.
