CVE-2026-28787 OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay
Attackers can bypass WebAuthn 2FA by replaying captured assertions because the server fails to validate the challenge against a stored value.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28787?
CVE-2026-28787 is a high-severity authentication bypass vulnerability in oneuptime, published on 6 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, §13.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available.
Which versions are affected by CVE-2026-28787?
2 open source packages ship an affected version, including @oneuptime/common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@oneuptime/common npm | All versions to 10.0.11 | None |
@oneuptime/common npm | All versions to 10.0.11 | None |
Products include Hackerbay Oneuptime.
How do I fix CVE-2026-28787?
No fix has been published for CVE-2026-28787 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-28787 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-28787 exists.
Other vulnerabilities in oneuptime
- CVE-2026-33396 Code injection in oneuptime
- CVE-2026-32306 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
- CVE-2026-30956 OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header
- CVE-2026-30957 OneUptime Synthetic Monitor RCE via exposed Playwright browser object
- CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
Sources
Also known as GHSA-gjjc-pcwp-c74m.