Is CVE-2025-66028 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66028 being exploited in the wild.

How severe is CVE-2025-66028?

High severity, with a CVSS score of 8.2, published 26 November 2025.

Which products and versions are affected?

@oneuptime/common (npm) SEMVER:introduced=0,fixed=8.0.5567; OneUptime before 8.0.5567.

Is there a fix for CVE-2025-66028?

Yes. @oneuptime/common (npm): upgrade to 8.0.5567 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66028 attacked?

It is attacked over the network.

Am I affected by CVE-2025-66028?

Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66028: OneUptime privilege escalation via login response manipulation

CVE-2025-66028 · Severity: high · CVSS 8.2 · Published 2025-11-26

OneUptime is an open-source monitoring and incident management platform. During login, attackers can intercept the authentication response and modify a flag that grants access to the admin dashboard, potentially exposing sensitive monitoring configuration and infrastructure data. Although actual data access controls limit further damage, the admin interface exposure represents a significant security boundary bypass.

Technologies: Hackerbay Oneuptime, @oneuptime/common (npm), OneUptime. Vendors: Hackerbay, npm, OneUptime.

Quick answers

Is CVE-2025-66028 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66028 being exploited in the wild.
How severe is CVE-2025-66028?: High severity, with a CVSS score of 8.2, published 26 November 2025.
Which products and versions are affected?: @oneuptime/common (npm) SEMVER:introduced=0,fixed=8.0.5567; OneUptime before 8.0.5567.
Is there a fix for CVE-2025-66028?: Yes. @oneuptime/common (npm): upgrade to 8.0.5567 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66028 attacked?: It is attacked over the network.
Am I affected by CVE-2025-66028?: Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@oneuptime/common (npm): upgrade to 8.0.5567 or later
```
npm install @oneuptime/common@8.0.5567
```

Technical details

The vulnerability is an improper access control issue (CWE-284, CWE-863) in the login response handling. The server includes an "isMasterAdmin" boolean parameter in the authentication response that determines dashboard access level. An attacker with network access can intercept the response and change this value from false to true, bypassing client-side privilege checks. The attack requires no authentication credentials and is network-reachable. While backend data access controls prevent full compromise, the attacker gains unauthorized visibility into the admin interface and configuration. The vulnerability is fixed in version 8.0.5567.

Affected products

OneUptime OneUptime before 8.0.5567

Identifiers

CVE-2025-66028
GHSA-675q-66gf-gqg8

Timeline

2025-11-25: disclosed: Advisory published as GHSA-675q-66gf-gqg8
2025-11-25: patched: Fix available in version 8.0.5567 (commit 3e72b2a9a4f50f98cf1f6cf13fa3e405715bb370)

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-675q-66gf-gqg8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.