Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

We only support our latest release with security updates.

Missing Authentication on Notification Endpoints
GHSA-q253-6wcm-h8hp published Mar 30, 2026 by simlarsen

Critical
Unauthenticated notification API endpoints: financial abuse via phone number purchase, service disruption, and SMTP credential exposure
GHSA-6wc5-rhvj-cx7f published Mar 30, 2026 by simlarsen

Critical
OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature Verification
GHSA-5w5c-766x-265g published Mar 31, 2026 by simlarsen

High
ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parameters
GHSA-gcg3-c5p2-cqgg published Mar 17, 2026 by simlarsen

High
Sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on Probe
GHSA-cqpg-phpp-9jjg published Mar 19, 2026 by simlarsen

Critical
WhatsApp Webhook Missing Signature Verification
GHSA-g5ph-f57v-mwjc published Mar 17, 2026 by simlarsen

High
Password Reset Token Logged at INFO Level
GHSA-4524-cj9j-g4fj published Mar 12, 2026 by simlarsen

High
Unauthenticated Workflow Execution via ManualAPI
GHSA-6c3w-7xg4-4cf7 published Apr 1, 2026 by simlarsen

High
RCE due to Node.js' vm module escape via error objects and infinite recursion
GHSA-g9cp-35m2-fjv6 published May 7, 2026 by simlarsen

Critical
Predictable Security Tokens Generated with UUID v1
GHSA-f5j9-g76m-vvp9 published Mar 12, 2026 by simlarsen

Moderate

Learn more about advisories related to OneUptime/oneuptime in the GitHub Advisory Database