Is CVE-2026-34840 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34840 being exploited in the wild.

How severe is CVE-2026-34840?

High severity, with a CVSS score of 8.1, published 2 April 2026.

Is there a fix for CVE-2026-34840?

A patch was published on 2026-03-31: Version 10.0.42 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34840 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-34840?

Check whether you run OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34840: OneUptime SAML SSO authentication bypass via identity injection

CVE-2026-34840 · Severity: high · CVSS 8.1 · Published 2026-04-02

OneUptime is an open-source platform used for monitoring and observability of IT infrastructure. A security flaw in its login system allows an attacker to bypass authentication and log in as any registered user, including administrators. By manipulating the login data sent from a single sign-on (SSO) provider, an attacker can gain unauthorized access to sensitive monitoring data and system configurations.

Technologies: OneUptime. Vendors: OneUptime.

Quick answers

Is CVE-2026-34840 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34840 being exploited in the wild.
How severe is CVE-2026-34840?: High severity, with a CVSS score of 8.1, published 2 April 2026.
Which products and versions are affected?: OneUptime < 10.0.42.
Is there a fix for CVE-2026-34840?: A patch was published on 2026-03-31: Version 10.0.42 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34840 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-34840?: Check whether you run OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the SAML SSO implementation within `App/FeatureSet/Identity/Utils/SSO.ts`. The root cause is a structural disconnect between how the system verifies cryptographic signatures and how it extracts user identity. Specifically, `isSignatureValid()` uses the `xml-crypto` library to verify the first `<Signature>` element found in the XML DOM, while `getEmail()` uses `xml2js` to always read the identity from the first assertion (`assertion[0]`). An attacker can exploit this by prepending an unsigned, malicious assertion containing a target user's email before a legitimately signed assertion. The system validates the signature on the second assertion but logs the user in based on the first, unsigned assertion. This is exploitable when the Identity Provider (IdP) uses assertion-level signatures rather than response-level signatures. The issue is fixed in version 10.0.42 by ensuring exactly one assertion is present.

Affected products

OneUptime OneUptime < 10.0.42

Timeline

2026-03-31: patched: Version 10.0.42 released
2026-03-31: advisory: GitHub Security Advisory GHSA-5w5c-766x-265g published
2026-04-02: disclosed: CVE-2026-34840 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.