Account Takeover Vulnerability in OneUptime Monitoring Solution

CVE-2026-32598

What is CVE-2026-32598?

OneUptime, a service monitoring and management tool, has a vulnerability that compromises account security by logging the complete password reset URL, which includes the plaintext reset token. This logging occurs at the INFO level by default, allowing anyone with access to the application logs to capture and misuse these tokens. If exploited, an attacker can gain unauthorized access to user accounts. The issue has been resolved in version 10.0.24, highlighting the importance of secure log management practices to prevent sensitive information leakage.

References