CVE-2026-34840High· 8.1▾ TwilightOneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/FeatureSet/Identity/Utils/SSO.ts) has decoupled signature verification and identity extraction. isSigna…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML SSO implementation (App/FeatureSet/Identity/Utils/SSO.ts) has decoupled signature verification and identity extraction. isSignatureValid() verifies the first <Signature> element in the XML DOM using xml-crypto, while getEmail() always reads from assertion[0] via xml2js. An attacker can prepend an unsigned assertion containing an arbitrary identity before a legitimately signed assertion, resulting in authentication bypass. This issue has been patched in version 10.0.42.
oneuptime < 10.0.42Upgrade past the affected range:
oneuptime 10.0.42Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35053Critical· 9.8OneUptime is an open-source monitoring and observability platform
CVE-2026-34758Critical· 9.1OneUptime is an open-source monitoring and observability platform
CVE-2026-34759High· 8.1OneUptime is an open-source monitoring and observability platform
CVE-2026-112047Medium· 5.4OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
CVE-2026-33396Critical· 9.9OneUptime is an open-source monitoring and observability platform
CVE-2026-33142High· 8.1OneUptime is a solution for monitoring and managing online services