CVE-2026-28787

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28787", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T14:25:19.244Z", "datePublished": "2026-03-06T04:55:40.678Z", "dateUpdated": "2026-03-09T19:46:22.314Z"}, "containers": {"cna": {"title": "OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-294", "lang": "en", "description": "CWE-294: Authentication Bypass by Capture-replay", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gjjc-pcwp-c74m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gjjc-pcwp-c74m"}], "affected": [{"vendor": "OneUptime", "product": "oneuptime", "versions": [{"version": "<= 10.0.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T04:55:40.678Z"}, "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, \u00a713.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available."}], "source": {"advisory": "GHSA-gjjc-pcwp-c74m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T19:46:13.788942Z", "id": "CVE-2026-28787", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:46:22.314Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28787", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T19:46:13.788942Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:46:18.758Z"}}], "cna": {"title": "OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay", "source": {"advisory": "GHSA-gjjc-pcwp-c74m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "OneUptime", "product": "oneuptime", "versions": [{"status": "affected", "version": "<= 10.0.11"}]}], "references": [{"url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gjjc-pcwp-c74m", "name": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gjjc-pcwp-c74m", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, \u00a713.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "CWE-294: Authentication Bypass by Capture-replay"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T04:55:40.678Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28787", "state": "PUBLISHED", "dateUpdated": "2026-03-09T19:46:22.314Z", "dateReserved": "2026-03-03T14:25:19.244Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T04:55:40.678Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oneuptime", "vendor": "OneUptime", "versions": [{"status": "affected", "version": "<= 10.0.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*", "matchCriteriaId": "01B6B6BB-F995-4484-9B9B-D1B690822055", "versionEndIncluding": "10.0.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification (W3C Web Authentication Level 2, \u00a713.4.3) and allows an attacker who has obtained a valid WebAuthn assertion (e.g., via XSS, MitM, or log exposure) to replay it indefinitely, completely bypassing the second-factor authentication. No known patches are available."}, {"lang": "es", "value": "OneUptime es una soluci\u00f3n para monitorear y gestionar servicios en l\u00ednea. En la versi\u00f3n 10.0.11 y anteriores, la implementaci\u00f3n de autenticaci\u00f3n WebAuthn no almacena el desaf\u00edo en el lado del servidor. En su lugar, el desaf\u00edo se devuelve al cliente y se acepta de nuevo desde el cuerpo de la solicitud del cliente durante la verificaci\u00f3n. Esto viola la especificaci\u00f3n WebAuthn (W3C Web Authentication Level 2, \u00a713.4.3) y permite a un atacante que ha obtenido una aserci\u00f3n WebAuthn v\u00e1lida (por ejemplo, a trav\u00e9s de XSS, MitM o exposici\u00f3n de registros) reproducirla indefinidamente, eludiendo completamente la autenticaci\u00f3n de segundo factor. No hay parches conocidos disponibles."}], "id": "CVE-2026-28787", "lastModified": "2026-06-17T10:29:02.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28787", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T19:46:13.788942Z", "version": "2.0.3"}}]}, "published": "2026-03-06T05:16:39.980", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gjjc-pcwp-c74m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-294"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.0.11]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "oneuptime", "source": "cna", "vendor": "OneUptime"}, "product": "oneuptime", "vendor": "oneuptime"}], "analysis": {"en": {"generated_at": "2026-04-17T12:24:43.853951+00:00", "value": {"mitigation_remediation": ["Deploy a vendor\u2011issued patch or update to a version that implements server\u2011side challenge storage when released.", "Implement network\u2011level controls or post\u2011authentication revocation to invalidate captured WebAuthn assertions immediately after first use, thereby preventing replay.", "Harden the web application against XSS and other attack vectors that could expose valid assertions, for example by enforcing strict Content Security Policies and input sanitization."], "summary": {"action": "Monitor", "impact": "Second\u2011factor authentication bypass via credential replay"}, "threat_synthesis": {"affected_systems": "Affected products are OneUptime versions 10.0.11 and earlier. The operation is limited to the OneUptime monitoring and management platform; any deployment of these versions is susceptible.", "description_and_impact": "The vulnerability lies in OneUptime's implementation of WebAuthn, which does not store the server\u2011generated challenge during the authentication dance. Instead, it echoes the challenge back to the client and validates the client\u2019s signed response against that echoed challenge. This deviation from the WebAuthn specification allows an adversary who has captured a valid WebAuthn assertion to replay it any number of times, effectively bypassing the second\u2011factor protection and gaining unauthorized access. The weakness is a classic authentication bypass (CWE\u2011287).", "risk_and_exploitability": "The CVSS score is 8.2, indicating a high\u2011severity flaw, while the EPSS score of less than 1% suggests exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. The likely attack path requires an attacker to obtain a valid WebAuthn assertion\u2014through cross\u2011site scripting, man\u2011in\u2011the\u2011middle interception, or log exposure\u2014and then replay that assertion to the server, which will accept it because it trusts the client\u2011supplied challenge. No patch is yet available, but the flaw is fully exploitable once the assertion is captured."}}}}, "created": "2026-03-06T14:55:41.449834+00:00", "updated": "2026-04-17T12:30:06.265382+00:00", "vendors": ["oneuptime", "oneuptime$PRODUCT$oneuptime"]}