Is CVE-2025-65966 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65966 being exploited in the wild.

How severe is CVE-2025-65966?

High severity, with a CVSS score of 8.1, published 26 November 2025.

Which products and versions are affected?

@oneuptime/common (npm) SEMVER:introduced=0,fixed=9.1.0.

Is there a fix for CVE-2025-65966?

Yes. @oneuptime/common (npm): upgrade to 9.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-65966 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-65966?

Check whether you run Hackerbay Oneuptime or @oneuptime/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65966: OneUptime unauthorized user creation via API

CVE-2025-65966 · Severity: high · CVSS 8.1 · Published 2025-11-26

OneUptime is an open-source monitoring and observability platform. A flaw in its API allows low-privileged users to create new user accounts without proper authorization checks, enabling attackers to gain unauthorized access to the system and potentially escalate privileges or compromise data.

Technologies: Hackerbay Oneuptime, @oneuptime/common (npm). Vendors: Hackerbay, npm.

Quick answers

Is CVE-2025-65966 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65966 being exploited in the wild.
How severe is CVE-2025-65966?: High severity, with a CVSS score of 8.1, published 26 November 2025.
Which products and versions are affected?: @oneuptime/common (npm) SEMVER:introduced=0,fixed=9.1.0.
Is there a fix for CVE-2025-65966?: Yes. @oneuptime/common (npm): upgrade to 9.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-65966 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-65966?: Check whether you run Hackerbay Oneuptime or @oneuptime/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@oneuptime/common (npm): upgrade to 9.1.0 or later
```
npm install @oneuptime/common@9.1.0
```

Technical details

The vulnerability is an improper authorization check (CWE-285) in the user-creation API endpoint. A low-permission authenticated user can craft a direct API request to bypass the intended interface restrictions and create new user accounts. The attack requires network access to the API and low-level authentication credentials, but no special user interaction. An attacker can successfully create unauthorized accounts, potentially leading to privilege escalation or unauthorized system access. The issue is fixed in version 9.1.0.

Affected products

OneUptime @oneuptime/common before 9.1.0

Identifiers

CVE-2025-65966
GHSA-m449-vh5f-574g

Timeline

2025-11-26: disclosed
2025-11-26: patched: Fixed in version 9.1.0

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.