CVE-2026-32598 OneUptime: Password Reset Token Logged at INFO Level

Medium 6.9 Published 12 Mar 2026 Updated 14 Mar 2026

Attackers with log access can steal password reset tokens from INFO logs to take over user accounts in OneUptime.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-32598?

CVE-2026-32598 is a medium-severity vulnerability in oneuptime, published on 12 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.

Weakness: CWE-532

Which versions are affected by CVE-2026-32598?

2 open source packages ship an affected version, including oneuptime. It affects 1 product.

Package	Affected	Fixed in
`oneuptime` npm	All versions	`10.0.23`
`oneuptime` npm	All versions	`10.0.23`

Products include Hackerbay Oneuptime.

How do I fix CVE-2026-32598?

Upgrade oneuptime to 10.0.23 or later.

Is CVE-2026-32598 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32598 exists.

Sources

Also known as GHSA-4524-cj9j-g4fj.