CVE-2026-34840 - Vulnerability Analysis

Overview

OneUptime < 10.0.42 contains an authentication bypass caused by decoupled signature verification and identity extraction in SAML SSO, letting attackers bypass authentication by prepending unsigned assertions, exploit requires crafted SAML response.

Severity & Score

Impact

Attackers can bypass authentication, gaining unauthorized access to user accounts and sensitive data.

Mitigation

Update to version 10.0.42 or later.

References

• https://github.com/OneUptime/oneuptime/commit/2fd7ede52f60444710628d6c1b34dee2ef9e57d1
• https://github.com/OneUptime/oneuptime/releases/tag/10.0.42
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-5w5c-766x-265g

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner