Description
The WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged webhook payloads that manipulate notification delivery status records, suppress alerts, and corrupt audit trails.
Recommendation
Update the oneuptime package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.0.34
- Patched version(s): 10.0.34
References
Could your website be exposed too?
SmartScanner can check your website for OneUptime WhatsApp Webhook Missing Signature Verification and gives you actionable findings to investigate.
Start a free scanRelated Issues
- OneUptime has WhatsApp Resend Verification Authorization Bypass - CVE-2026-30959
- OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover - CVE-2026-44720
- dcap-qvl has Missing Verification for QE Identity - CVE-2026-22696
- jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass - CVE-2026-4602
You might also like:
See something that needs correcting? Let us knowUpdated March 20, 2026