# CVE-2025-66028: OneUptime privilege escalation via login response manipulation

Source: https://junglewise.ai/threats/cve-2025-66028-oneuptime-privilege-escalation-via-login-response-manipulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-66028 · Severity: high · CVSS 8.2 · Published 2025-11-26

OneUptime is an open-source monitoring and incident management platform. During login, attackers can intercept the authentication response and modify a flag that grants access to the admin dashboard, potentially exposing sensitive monitoring configuration and infrastructure data. Although actual data access controls limit further damage, the admin interface exposure represents a significant security boundary bypass.

Technologies: [Hackerbay Oneuptime](https://junglewise.ai/threats/technologies/hackerbay-oneuptime), [@oneuptime/common (npm)](https://junglewise.ai/threats/technologies/oneuptime-common), [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [Hackerbay](https://junglewise.ai/threats/vendors/hackerbay), [npm](https://junglewise.ai/threats/vendors/npm), [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2025-66028 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66028 being exploited in the wild.

**How severe is CVE-2025-66028?** High severity, with a CVSS score of 8.2, published 26 November 2025.

**Which products and versions are affected?** @oneuptime/common (npm) SEMVER:introduced=0,fixed=8.0.5567; OneUptime before 8.0.5567.

**Is there a fix for CVE-2025-66028?** Yes. @oneuptime/common (npm): upgrade to 8.0.5567 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66028 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-66028?** Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @oneuptime/common (npm): upgrade to 8.0.5567 or later

  ```sh
  npm install @oneuptime/common@8.0.5567
  ```


## Technical details

The vulnerability is an improper access control issue (CWE-284, CWE-863) in the login response handling. The server includes an "isMasterAdmin" boolean parameter in the authentication response that determines dashboard access level. An attacker with network access can intercept the response and change this value from false to true, bypassing client-side privilege checks. The attack requires no authentication credentials and is network-reachable. While backend data access controls prevent full compromise, the attacker gains unauthorized visibility into the admin interface and configuration. The vulnerability is fixed in version 8.0.5567.

## Affected products

- OneUptime OneUptime before 8.0.5567

## Identifiers

- CVE-2025-66028
- GHSA-675q-66gf-gqg8

## Timeline

- 2025-11-25: disclosed: Advisory published as GHSA-675q-66gf-gqg8
- 2025-11-25: patched: Fix available in version 8.0.5567 (commit 3e72b2a9a4f50f98cf1f6cf13fa3e405715bb370)

## References

- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-675q-66gf-gqg8](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-675q-66gf-gqg8)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime webhook SSRF via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime missing authentication in Worker ManualAPI workflow execution](https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)