OneUptime is a solution for monitoring and managing online services.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 13, 2026 · NIST NVD

   Detected

   OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on

2. Oct 7, 2026 · NIST NVD

   Updated

   OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on

Affected

• cpe hackerbay/oneuptimeversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-32598

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-32598

  OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to applica

  nvd.nist.gov

References

• Exploit · github.com