Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34759 OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication… https://www.cve.org/CVERecord?id=CVE-2026-34759
Post summary
The post announces a new CVE in OneUptime, noting that before version 10.0.42 certain API endpoints lack authentication, and references the CVE record.
🚨 CVE-2026-34759: OneUptime: Unauthenticated notif... Missing auth middleware on notification endpoints lets attackers rack up Twilio bills and nuke alerting systems via lea... https://zerodaysignal.com/vulnerability/CVE-2026-34759 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces that CVE-2026-34759 in OneUptime permits unauthenticated access to notification endpoints, enabling attackers to inflate Twilio bills and disrupt alert systems; no active exploitation or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hackerbay | oneuptime | - | - | - |