OneUptime has WhatsApp Resend Verification Authorization Bypass

Vulnerability

CVE-2026-30959 is an authorization bypass vulnerability in OneUptime, an open-source monitoring and observability platform [2]. The resend-verification-code endpoint in UserWhatsAppAPI.ts does not validate that the authenticated user owns the UserWhatsApp record being targeted [1][3]. Unlike the verify endpoint which includes an ownership check, the resend endpoint only requires a valid authenticated session and the victim's UserWhatsApp record ID [3]. This flaw is present in both the API endpoint and the underlying service (UserWhatsAppService.ts) [1].

Exploitation

An authenticated attacker with a valid access token can trigger a verification code resend for any UserWhatsApp record that belongs to the same project [3]. The attack requires knowing the target record's itemId, which could be obtained through other means or by enumeration [1]. The attacker sends a POST request to /api/user-whats-app/resend-verification-code with the victim's itemId in the request body [3]. The server responds with HTTP 200 and a new verification code is sent to the victim's WhatsApp number without any confirmation from the legitimate user [3].

Impact

The ability to resend verification codes for arbitrary users undermines the security of the WhatsApp-based authentication or notification channels in OneUptime [1][3]. An attacker could repeatedly trigger resend requests, potentially causing account takeover, identity confusion, or denial of service by flooding the victim with verification messages [3]. Since the flaw is in a core authentication mechanism, the impact may extend to system-wide security, including unauthorized access to monitoring data, status pages, incident management, and other sensitive features [2].

Mitigation

The vendor has addressed this vulnerability in release 10.0.21 of OneUptime [4]. Users should update to this version or later to apply the fix [4]. No workarounds are documented, but administrators can temporarily restrict access to the affected endpoint until the update can be applied [1][3].