Home / Vulnerability Intelligence / CVE-2026-34758

CVE-2026-34758 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: April 2, 2026

OneUptime - Authentication Bypass

Published: April 2, 2026Updated: April 2, 2026Remote Exploitable

Overview

OneUptime < 10.0.42 contains an authentication bypass caused by unauthenticated access to Notification test and Phone Number management endpoints, letting unauthenticated attackers abuse SMS/Call/Email/WhatsApp and purchase phone numbers, exploit requires no authentication.

Severity & Score

Severity: Critical

CVSS Score: 9.1

Impact

Unauthenticated attackers can abuse communication services and purchase phone numbers, leading to service abuse and potential financial loss.

Mitigation

Update to version 10.0.42 or later.

References

https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4
https://github.com/OneUptime/oneuptime/releases/tag/10.0.42
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-q253-6wcm-h8hp

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-34758
Severity: Critical
CVSS Score: 9.1
Type: broken_authentication
Status: new

CWE

CWE-306

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N