CVE-2026-32598CWE-532

CVE-2026-32598

Medium · published March 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
24.7
In the wild
Unconfirmed
What it is

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00328 · 24.7th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-03-13T23:55Z
Affected products (1)
ProductVersionsFixed in
hackerbay/oneuptime< 10.0.2410.0.24
References (1)
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4524-cj9j-g4fj · [email protected]
EPSS history
Timeline
  • 12 MAR 21:31Z
    OneUptime: Password Reset Token Logged at INFO Level
    cvelistv5