CVE-2026-28787
OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, §13.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- EPSS probability
- 0.28%
- CWE
- CWE-287, CWE-294
- Published
- 2026-03-06
- Last modified
- 2026-03-16
Affected products
- OneUptime oneuptime
Weakness type
Related vulnerabilities
- CVE-2026-87016 — Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
- CVE-2026-47156 — MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-87806 — Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password
- CVE-2026-79974 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-80099 — Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret
- CVE-2026-76009 — Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
- CVE-2026-78560 — Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source
- CVE-2026-86810 — Open-Web-Analytics Controller Controller.php checkCapabilityAndAuthenticateUser improper authentication