Loading...
Skip to main content
GeekWala

CVE-2025-65966 — Vulnerability in @oneuptime/common — CVE Details

HIGH

OneUptime Unauthorized User Creation via API

Published November 26, 2025Updated December 1, 2025Source: osv

Summary

### Summary A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. ### PoC A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully. ![WhatsApp Image 2025-11-23 at 14 27 32_0e0f5889](https://github.com/user-attachments/assets/5a539310-c9a2-4466-8926-b49b9b2a2422) ### Impact This allows attackers to create unauthorized accounts.

Advisory Timeline

  • First published November 26, 2025 (320 days ago).
  • Last revised December 1, 2025 — 5 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update @oneuptime/common to 9.1.0 or later
npm install @oneuptime/common@9.1.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

PackageEcosystemAffectedFixed In
@oneuptime/common
npm
All versions9.1.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-285
    Improper AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2025-65966?
OneUptime Unauthorized User Creation via API This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2025-65966?
CVE-2025-65966 affects @oneuptime/common. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-65966 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-m449-vh5f-574g

Related CVEs

  • CVE-2026-30921
    CRITICAL

    OneUptime: Synthetic Monitor RCE via exposed Playwright browser object

  • CVE-2026-30887
    CRITICAL

    OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

  • CVE-2026-27728
    CRITICAL

    OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()

  • CVE-2026-30957
    CRITICAL

    OneUptime has Synthetic Monitor RCE via exposed Playwright browser object

  • CVE-2026-30956
    CRITICAL

    OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover

  • CVE-2026-27574
    CRITICAL

    OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE

  • CVE-2026-107375
    HIGH

    JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

  • CVE-2026-107384
    HIGH

    MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies