Executive brief
OneUptime's WhatsApp notification service receives webhook events from Meta/WhatsApp to track message delivery status. An attacker can send fake webhook requests without authentication to manipulate delivery records, causing the system to incorrectly report that failed notifications were delivered, suppressing critical alerts and corrupting audit logs.
Technical details
The WhatsApp POST webhook endpoint (/notification/whatsapp/webhook) in OneUptime lacks HMAC signature verification for incoming Meta/WhatsApp events, accepting any unauthenticated payload. The vulnerability exists in App/FeatureSet/Notification/API/WhatsApp.ts (lines 372–430), where the code processes webhook entries without checking the X-Hub-Signature-256 header. The codebase already implements correct signature validation for Slack webhooks, demonstrating this is a known pattern the developers omitted for WhatsApp. An unauthenticated remote attacker can forge delivery status updates, inject arbitrary messages, and manipulate notification logs with network access to the endpoint. The fix is available in version 10.0.34.
Affected products
- OneUptime OneUptime all versions up to and including 10.0.23; fixed in 10.0.34
Timeline
- 2026-03-18: disclosed: Public advisory published
- 2026-03-18: patched: Fix available in version 10.0.34