CVE-2026-28787 - Vulnerability Analysis

Overview

OneUptime <= 10.0.11 contains a broken authentication caused by improper WebAuthn challenge handling, letting attackers replay valid assertions to bypass second-factor authentication, exploit requires attacker to have a valid WebAuthn assertion.

Severity & Score

Impact

Attackers can bypass second-factor authentication by replaying valid WebAuthn assertions, compromising account security.

Mitigation

Update to the latest version when a patch becomes available.

References

• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gjjc-pcwp-c74m

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner