6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32598

CVE-2026-32598: OneUptime: Password Reset Token Logged at INFO Level

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32598

CVE-2026-32598:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
oneuptime	npm	< 10.0.23	10.0.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the password reset functionality of OneUptime. The application was logging the complete password reset URL, which includes the sensitive password reset token, at the INFO log level. Since INFO level is typically enabled in production environments, these tokens were exposed in application logs. An attacker with access to these logs could intercept a token and use it to reset a user's password, leading to account takeover. The analysis of the commits between the vulnerable version (10.0.22) and the patched version (10.0.24) revealed a commit that specifically addresses this issue. The commit 27ecf7625435823d36ea438dfca502b929fdb3ba changes the log level for the password reset URL from INFO to DEBUG in the file App/FeatureSet/Identity/API/Authentication.ts. The vulnerable function is the route handler for the POST /forgot-password endpoint, which contains the insecure logging statement. The patch confirms this by modifying the logger.info call to logger.debug, thus mitigating the vulnerability by default in production environments.

Vulnerable functions

forgotPassword

App/FeatureSet/Identity/API/Authentication.ts

The function handles the 'forgot password' request. It was logging the password reset URL, which contained the plaintext reset token, at the INFO level. This would allow anyone with access to the application logs to intercept the token and take over the user's account. The function is the anonymous callback for the `POST /forgot-password` route.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.