# CVE-2026-30959: OneUptime WhatsApp resend verification authorization bypass

Source: https://junglewise.ai/threats/cve-2026-30959-oneuptime-whatsapp-resend-verification-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30959 · Severity: medium · CVSS 5 · Published 2026-03-10

OneUptime is an open-source monitoring and incident management platform. A flaw in its WhatsApp verification endpoint allows any authenticated user to trigger verification code resends for other users' WhatsApp accounts without ownership validation. This enables attackers to spam victims with unwanted verification codes, disrupt their service, and create social engineering opportunities.

Technologies: [Hackerbay Oneuptime](https://junglewise.ai/threats/technologies/hackerbay-oneuptime), [@oneuptime/common (npm)](https://junglewise.ai/threats/technologies/oneuptime-common), [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [Hackerbay](https://junglewise.ai/threats/vendors/hackerbay), [npm](https://junglewise.ai/threats/vendors/npm), [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2026-30959 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30959 being exploited in the wild.

**How severe is CVE-2026-30959?** Medium severity, with a CVSS score of 5, published 10 March 2026.

**Which products and versions are affected?** @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.21; OneUptime < 10.0.21.

**Is there a fix for CVE-2026-30959?** Yes. @oneuptime/common (npm): upgrade to 10.0.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30959 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-30959?** Check whether you run Hackerbay Oneuptime, @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @oneuptime/common (npm): upgrade to 10.0.21 or later

  ```sh
  npm install @oneuptime/common@10.0.21
  ```


## Technical details

The vulnerability is an authorization bypass in the resend-verification-code API endpoint (UserWhatsAppAPI.ts). The endpoint accepts an itemId parameter and triggers a verification code resend without validating that the authenticated user owns the target WhatsApp record, unlike the corresponding verify endpoint which does perform ownership checks. An attacker with a valid project account and access token can specify any victim's UserWhatsApp itemId to trigger unsolicited resends. The attack requires authentication but no user interaction. Impact includes SMS/WhatsApp spam, denial-of-service against phone numbers, and account lockout scenarios. The fix was released in version 10.0.21, which adds ownership validation (item.userId must match authenticated user) and rate limiting.

## Affected products

- OneUptime OneUptime < 10.0.21

## Identifiers

- CVE-2026-30959
- GHSA-cw6x-mw64-q6pv

## Timeline

- 2026-03-10: disclosed
- 2026-03-10: patched: Version 10.0.21 released with fix

## References

- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime webhook SSRF via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime missing authentication in Worker ManualAPI workflow execution](https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)