CVE-2026-32598

OneUptime: Password Reset Token Logged at INFO Level

State: Published
Severity: 6.9 Medium
Published: Mar 12, 2026
Updated: Mar 14, 2026
Reserved: Mar 12, 2026

Description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user. This vulnerability is fixed in 10.0.24.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-532 Insertion of Sensitive Information into Log File

Affected Products

Product	Versions
oneuptimeOneUptime	< 10.0.24Affected

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4524-cj9j-g4fj

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.