# CVE-2023-44400: Uptime Kuma persistent session tokens after password change

Source: https://junglewise.ai/threats/cve-2023-44400-uptime-kuma-persistent-session-tokens-after-password-change  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-10-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-44400 · Severity: low · CVSS 3.1 · Published 2023-10-10

Uptime Kuma is an open-source monitoring application that tracks the availability of websites and services. An attacker with local access to a user's device can permanently hijack the user's account by reusing session tokens that remain valid even after password changes or prolonged inactivity. This allows unauthorized access to sensitive monitoring data, API credentials, and the ability to modify or delete monitored services.

Technologies: [uptime-kuma (npm)](https://junglewise.ai/threats/technologies/uptime-kuma). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-44400 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-44400 being exploited in the wild.

**How severe is CVE-2023-44400?** Low severity, with a CVSS score of 3.1, published 10 October 2023.

**Which products and versions are affected?** uptime-kuma (npm) SEMVER:introduced=0,fixed=1.23.3.

**Is there a fix for CVE-2023-44400?** Yes. uptime-kuma (npm): upgrade to 1.23.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-44400 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2023-44400?** Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- uptime-kuma (npm): upgrade to 1.23.3 or later

  ```sh
  npm install uptime-kuma@1.23.3
  ```


## Technical details

The vulnerability stems from improper session management in Uptime Kuma's JWT token implementation (CWE-565, CWE-602, CWE-784). JWT tokens are stored in browser storage (sessionStorage or localStorage) and lack server-side validation after password changes or timeout periods. Specifically: (1) tokens have no expiration time and remain valid indefinitely, (2) password changes do not invalidate previously issued tokens on the server side, and (3) session tokens are only deleted client-side on logout, making them reusable by local attackers. The attack requires local device access (AV:Local, PR:High privilege level) and no user interaction. An attacker can gain persistent account access to view private monitors, access API keys and secrets, modify monitored endpoints, and exhaust system resources. The vulnerability is fixed in version 1.23.3 and later.

## Affected products

- Louis Lam Uptime Kuma before 1.23.3

## Identifiers

- CVE-2023-44400
- GHSA-g9v2-wqcj-j99g

## Timeline

- 2023-10-09: disclosed
- 2023-10-10: patched: fixed in version 1.23.3

## References

- [https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g)

## Related threats

- [Uptime Kuma missing authorization check on ping badge endpoint](https://junglewise.ai/threats/cve-2026-32230-uptime-kuma-missing-authorization-check-on-ping-badge-endpoint)
- [Uptime Kuma Server-side Template Injection in notification templates](https://junglewise.ai/threats/uptime-kuma-server-side-template-injection-in-notification-templates-8547405a)
- [Uptime Kuma ReDoS in pushdeer and whapi notification providers](https://junglewise.ai/threats/cve-2025-26042-uptime-kuma-redos-in-pushdeer-and-whapi-notification-providers)
- [Uptime Kuma ReDoS in notification provider configuration](https://junglewise.ai/threats/uptime-kuma-redos-in-notification-provider-configuration-e7e79209)
- [Uptime Kuma authenticated remote code execution via plugin installation](https://junglewise.ai/threats/cve-2023-36821-uptime-kuma-authenticated-remote-code-execution-via-plugin)