Webhook Vulnerability in OneUptime's WhatsApp Notification System
CVE-2026-33143

8.7HIGH

Key Information:

Vendor

Oneuptime

Status
Oneuptime
Vendor
CVE Published:
20 March 2026

What is CVE-2026-33143?

OneUptime, a service management solution, had a significant vulnerability prior to version 10.0.34 in its WhatsApp POST webhook handler. This issue allows attackers to exploit the lack of validation for the Meta/WhatsApp X-Hub-Signature-256 HMAC signature. Consequently, unauthenticated users can send forged webhook payloads, leading to improper manipulation of notification delivery statuses, suppression of alerts, and corruption of audit trails. Although this vulnerability was not present in the Slack webhook implementation, it has been addressed in the latest version, ensuring enhanced security for users.

Affected Version(s)

oneuptime < 10.0.34

References

https://github.com/OneUptime/oneuptime/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.