Description
The password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user.
Recommendation
Update the oneuptime package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.0.23
- Patched version(s): 10.0.23
References
Could your website be exposed too?
SmartScanner can check your website for OneUptime: Password Reset Token Logged at INFO Level and gives you actionable findings to investigate.
Start a free scanRelated Issues
- StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation - CVE-2026-32103
- Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - CVE-2026-22706
- Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706
- OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() - CVE-2026-27728
You might also like:
See something that needs correcting? Let us knowUpdated March 16, 2026