5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30959

CVE-2026-30959: OneUptime has WhatsApp Resend Verification Authorization Bypass

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30959

CVE-2026-30959:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@oneuptime/common	npm	< 10.0.21	10.0.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in an authorization bypass within the resend-verification-code endpoints for UserWhatsApp, UserCall, UserEmail, and UserSms. The advisory and the patch commit ea57608ca677962e3664e66c498aba85856ab7dc clearly show that these endpoints lacked a critical ownership check. An authenticated attacker could provide the itemId of any user's contact method and trigger a verification code resend. The vulnerable functions are the anonymous route handlers within the API classes (UserWhatsAppAPI, UserCallAPI, UserEmailAPI, UserSmsAPI) that were responsible for handling these requests. The patch remediated this by adding logic to fetch the item associated with the itemId and verifying that its userId matches the ID of the authenticated user making the request. The analysis identified the anonymous functions within the constructors of these API classes as the precise location of the vulnerability.

Vulnerable functions

UserWhatsAppAPI.<anonymous>

Common/Server/API/UserWhatsAppAPI.ts

This anonymous function, which serves as the route handler for resending WhatsApp verification codes, was vulnerable. It processed requests without verifying that the `itemId` belonged to the authenticated user. This allowed any authenticated user to trigger a verification code resend for an arbitrary user's WhatsApp account, leading to a potential denial-of-service or social engineering attacks.

UserCallAPI.<anonymous>

Common/Server/API/UserCallAPI.ts

This anonymous function, which serves as the route handler for resending voice call verification codes, was vulnerable. It processed requests without verifying that the `itemId` belonged to the authenticated user. This allowed any authenticated user to trigger a verification code resend for an arbitrary user's phone number, leading to a potential denial-of-service or social engineering attacks.

UserEmailAPI.<anonymous>

Common/Server/API/UserEmailAPI.ts

This anonymous function, which serves as the route handler for resending email verification codes, was vulnerable. It processed requests without verifying that the `itemId` belonged to the authenticated user. This allowed any authenticated user to trigger a verification code resend for an arbitrary user's email address, leading to a potential denial-of-service or social engineering attacks.

UserSmsAPI.<anonymous>

Common/Server/API/UserSmsAPI.ts

This anonymous function, which serves as the route handler for resending SMS verification codes, was vulnerable. It processed requests without verifying that the `itemId` belonged to the authenticated user. This allowed any authenticated user to trigger a verification code resend for an arbitrary user's phone number, leading to a potential denial-of-service or social engineering attacks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.