# CVE-2025-65966: OneUptime unauthorized user creation via API

Source: https://junglewise.ai/threats/cve-2025-65966-oneuptime-unauthorized-user-creation-via-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-65966 · Severity: high · CVSS 8.1 · Published 2025-11-26

OneUptime is an open-source monitoring and observability platform. A flaw in its API allows low-privileged users to create new user accounts without proper authorization checks, enabling attackers to gain unauthorized access to the system and potentially escalate privileges or compromise data.

Technologies: [Hackerbay Oneuptime](https://junglewise.ai/threats/technologies/hackerbay-oneuptime), [@oneuptime/common (npm)](https://junglewise.ai/threats/technologies/oneuptime-common). Vendors: [Hackerbay](https://junglewise.ai/threats/vendors/hackerbay), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-65966 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65966 being exploited in the wild.

**How severe is CVE-2025-65966?** High severity, with a CVSS score of 8.1, published 26 November 2025.

**Which products and versions are affected?** @oneuptime/common (npm) SEMVER:introduced=0,fixed=9.1.0.

**Is there a fix for CVE-2025-65966?** Yes. @oneuptime/common (npm): upgrade to 9.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-65966 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-65966?** Check whether you run Hackerbay Oneuptime or @oneuptime/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @oneuptime/common (npm): upgrade to 9.1.0 or later

  ```sh
  npm install @oneuptime/common@9.1.0
  ```


## Technical details

The vulnerability is an improper authorization check (CWE-285) in the user-creation API endpoint. A low-permission authenticated user can craft a direct API request to bypass the intended interface restrictions and create new user accounts. The attack requires network access to the API and low-level authentication credentials, but no special user interaction. An attacker can successfully create unauthorized accounts, potentially leading to privilege escalation or unauthorized system access. The issue is fixed in version 9.1.0.

## Affected products

- OneUptime @oneuptime/common before 9.1.0

## Identifiers

- CVE-2025-65966
- GHSA-m449-vh5f-574g

## Timeline

- 2025-11-26: disclosed
- 2025-11-26: patched: Fixed in version 9.1.0

## References

- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g)

## Related threats

- [OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged…](https://junglewise.ai/threats/cve-2026-33396-oneuptime-is-an-open-source-monitoring-and-observability-platform)
- [OneUptime WhatsApp Webhook signature verification bypass](https://junglewise.ai/threats/cve-2026-33143-oneuptime-whatsapp-webhook-signature-verification-bypass)
- [OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for (ClickHouse SQL in](https://junglewise.ai/threats/cve-2026-33142-oneuptime-clickhouse-sql-injection-in-query-parameters)
- [OneUptime password reset token logged at INFO level](https://junglewise.ai/threats/cve-2026-32598-oneuptime-password-reset-token-logged-at-info-level)
- [OneUptime stored XSS in Mermaid diagram rendering](https://junglewise.ai/threats/cve-2026-32308-oneuptime-stored-xss-in-mermaid-diagram-rendering)