# CVE-2026-32598: OneUptime password reset token logged at INFO level

Source: https://junglewise.ai/threats/cve-2026-32598-oneuptime-password-reset-token-logged-at-info-level  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-32598 · Severity: medium · CVSS 6.5 · Published 2026-03-13

OneUptime is an open-source monitoring and observability platform that enables account password resets. The application logs the complete password reset URL—containing a plaintext reset token—at the INFO level by default in production. This means any person with access to logs (whether in Docker, Kubernetes, log aggregation systems like Elasticsearch or Datadog, or shared log volumes) can extract these tokens and take over any user account in the system.

Technologies: [Hackerbay Oneuptime](https://junglewise.ai/threats/technologies/hackerbay-oneuptime), [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [Hackerbay](https://junglewise.ai/threats/vendors/hackerbay), [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2026-32598 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32598 being exploited in the wild.

**How severe is CVE-2026-32598?** Medium severity, with a CVSS score of 6.5, published 13 March 2026.

**Which products and versions are affected?** OneUptime all versions up to 10.0.23.

**Is there a fix for CVE-2026-32598?** A patch was published on 2026-03-13: Fixed in version 10.0.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32598 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-32598?** Check whether you run Hackerbay Oneuptime or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a sensitive information disclosure (CWE-532) in the password reset flow. The vulnerable code in App/FeatureSet/Identity/API/Authentication.ts (lines 370-371) logs the complete password reset URL containing the plaintext token via logger.info(). This log level is enabled by default in production and persists to stdout, log files, and any configured log aggregation systems. The attack requires only read access to application logs—no authentication or network traversal is needed beyond accessing the logging infrastructure. An attacker can extract the plaintext token, then call the reset-password API endpoint with the stolen token to reset the victim's password. Additionally, login credentials (including cleartext passwords) are logged at DEBUG level (line 909), which is commonly enabled during incident troubleshooting. The vulnerability affects all versions of OneUptime up to and including 10.0.23 and is patched in 10.0.24.

## Affected products

- OneUptime oneuptime all versions up to 10.0.23

## Identifiers

- CVE-2026-32598
- GHSA-4524-cj9j-g4fj

## Timeline

- 2026-03-13: disclosed: Advisory published
- 2026-03-13: patched: Fixed in version 10.0.24

## References

- [https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4524-cj9j-g4fj](https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4524-cj9j-g4fj)
- [https://github.com/OneUptime/oneuptime](https://github.com/OneUptime/oneuptime)
- [https://github.com/OneUptime/oneuptime/releases/tag/10.0.23](https://github.com/OneUptime/oneuptime/releases/tag/10.0.23)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime webhook SSRF via IPv4-mapped IPv6 addresses](https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime missing authentication in Worker ManualAPI workflow execution](https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)