Moderate severityNVD Advisory· Published Mar 12, 2026· Updated Mar 14, 2026
OneUptime: Password Reset Token Logged at INFO Level
CVE-2026-32598
Description
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
oneuptimenpm | < 10.0.23 | 10.0.23 |
Affected products
2- OneUptime/oneuptimev5Range: < 10.0.24
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-4524-cj9j-g4fjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32598ghsaADVISORY
- github.com/OneUptime/oneuptime/releases/tag/10.0.23ghsaWEB
- github.com/OneUptime/oneuptime/security/advisories/GHSA-4524-cj9j-g4fjghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.