Is CVE-2026-30959 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30959 being exploited in the wild.

How severe is CVE-2026-30959?

Medium severity, with a CVSS score of 5, published 10 March 2026.

Which products and versions are affected?

@oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.21; OneUptime < 10.0.21.

Is there a fix for CVE-2026-30959?

Yes. @oneuptime/common (npm): upgrade to 10.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30959 attacked?

It is attacked over the network.

Am I affected by CVE-2026-30959?

Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30959: OneUptime WhatsApp resend verification authorization bypass

Q: Is there a fix for CVE-2026-30959?

Yes. @oneuptime/common (npm): upgrade to 10.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-30959 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-30959?

Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30959 · Severity: medium · CVSS 5 · Published 2026-03-10

OneUptime is an open-source monitoring and incident management platform. A flaw in its WhatsApp verification endpoint allows any authenticated user to trigger verification code resends for other users' WhatsApp accounts without ownership validation. This enables attackers to spam victims with unwanted verification codes, disrupt their service, and create social engineering opportunities.

Technologies: Hackerbay Oneuptime, @oneuptime/common (npm), OneUptime. Vendors: Hackerbay, npm, OneUptime.

Quick answers

Is CVE-2026-30959 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30959 being exploited in the wild.
How severe is CVE-2026-30959?: Medium severity, with a CVSS score of 5, published 10 March 2026.
Which products and versions are affected?: @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.21; OneUptime < 10.0.21.
Is there a fix for CVE-2026-30959?: Yes. @oneuptime/common (npm): upgrade to 10.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30959 attacked?: It is attacked over the network.
Am I affected by CVE-2026-30959?: Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@oneuptime/common (npm): upgrade to 10.0.21 or later
```
npm install @oneuptime/common@10.0.21
```

Technical details

The vulnerability is an authorization bypass in the resend-verification-code API endpoint (UserWhatsAppAPI.ts). The endpoint accepts an itemId parameter and triggers a verification code resend without validating that the authenticated user owns the target WhatsApp record, unlike the corresponding verify endpoint which does perform ownership checks. An attacker with a valid project account and access token can specify any victim's UserWhatsApp itemId to trigger unsolicited resends. The attack requires authentication but no user interaction. Impact includes SMS/WhatsApp spam, denial-of-service against phone numbers, and account lockout scenarios. The fix was released in version 10.0.21, which adds ownership validation (item.userId must match authenticated user) and rate limiting.

Affected products

OneUptime OneUptime < 10.0.21

Identifiers

CVE-2026-30959
GHSA-cw6x-mw64-q6pv

Timeline

2026-03-10: disclosed
2026-03-10: patched: Version 10.0.21 released with fix

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.