OneUptime: Password Reset Token Logged at INFO Level

Description

The password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs (log aggregation, Docker logs, Kubernetes pod logs) can intercept reset tokens and perform account takeover on any user.

Recommendation

Update the oneuptime package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.0.23
• Patched version(s): 10.0.23

References

• GHSA-4524-cj9j-g4fj
• CVE-2026-32598
• CWE-532
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A9

Related Issues

• StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation - CVE-2026-32103
• Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - CVE-2026-22706
• Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706
• OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() - CVE-2026-27728

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

oneuptime